Node.js Module axios < 0.33.0 / 1.x < 1.18.0 Prototype Pollution

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(333249);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/07");

  script_cve_id("CVE-2026-67316", "CVE-2026-67319");
  script_xref(name:"IAVA", value:"2026-A-0804");
  script_cwe_id(1321);

  script_name(english:"Node.js Module axios < 0.33.0 / 1.x < 1.18.0 Prototype Pollution");

  script_set_attribute(attribute:"synopsis", value:
"A module in the Node.js JavaScript run-time environment is affected by multiple prototype pollution vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of the axios Node.js module installed on the remote host is prior to 0.33.0 or 1.x prior to 1.18.0. It is,
therefore, affected by multiple vulnerabilities:

  - axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when
    Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method
    aliases, inherited data is read via (config || {}).data before config normalization, causing an
    attacker-controlled body to be sent on requests that did not set one. (CVE-2026-67316)

  - axios can consume inherited properties from nested request option objects when the JavaScript process's
    Object.prototype has already been polluted by another component. Nested plain objects such as auth and
    paramsSerializer are cloned into ordinary objects and read without own-property checks. (CVE-2026-67319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b0de3f5a");
  # https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?185e21ab");
  script_set_attribute(attribute:"solution", value:
"Upgrade to axios version 0.33.0 / 1.18.0 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-67316");

  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:axios:axios");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("installed_sw/Node.js", "Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

var app_info = vcf_extras::nodejs_modules::get_app_info(app:'axios');

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, 'axios');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  { 'fixed_version' : '0.33.0' },
  { 'min_version' : '1.0.0', 'fixed_version' : '1.18.0' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);