{"uuid": "d591a719-f75f-4975-b090-c3df51b694a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/366", "content": "CVE-2026-40175\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0, the Axios library is vulnerable to a specific \"Gadget\" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0.\n\nGitHub Link:\nhttps://github.com/LeeKangHyun/axios-security-guide", "creation_timestamp": "2026-08-28T00:00:30.741021Z"}