-
Notifications
You must be signed in to change notification settings - Fork 3.4k
Vulnerability in Archon project #1053
Copy link
Copy link
Closed
Labels
P2Medium priority - Backlog, when time permitsMedium priority - Backlog, when time permitsarea: infraDocker, deployment, CI/CDDocker, deployment, CI/CDbugSomething is brokenSomething is brokeneffort/lowSingle file or function, one responsibility, isolated changeSingle file or function, one responsibility, isolated change
Description
Metadata
Metadata
Assignees
Labels
P2Medium priority - Backlog, when time permitsMedium priority - Backlog, when time permitsarea: infraDocker, deployment, CI/CDDocker, deployment, CI/CDbugSomething is brokenSomething is brokeneffort/lowSingle file or function, one responsibility, isolated changeSingle file or function, one responsibility, isolated change
While working on Archon project, I scanned the dependency manifest and found that the application uses a vulnerable version of axios affected by CVE-2025-62718. This vulnerability allows bypassing NO_PROXY rules due to improper hostname normalization (e.g., localhost. or [::1]). As a result, requests intended to bypass proxies may instead be routed through a proxy, potentially exposing sensitive internal services and leading to SSRF risks.
CVE Report
CVE Link