Vulnerabilities - ETHcode - Visual Studio Code | ReversingLabs Spectra Assure Community

List of known vulnerabilities affecting the software package and the components it embeds. Last refreshed on: 2026/06/24

All detected vulnerabilities are fixable

Run the update/upgrade command in your package manager to resolve the detected vulnerabilities

Hide triaged

CVSS Score

CVE Identifier

Summary

Tags

critical

10.0

CVE-2026-42043

Axios is vulnerable to a NO_PROXY protection bypass via the RFC 1122 loopback subnet (127.0.0.0/8).

Exploits Exist

Fix Available

critical

9.4

CVE-2025-7783

form-data uses insufficiently random values, allowing HTTP Parameter Pollution (HPP) due to an issue in lib/form_data.js.

Exploits Exist

Fix Available

critical

9.1

CVE-2026-42044

Axios is vulnerable to a Prototype Pollution 'Gadget' attack that allows modification of JSON API responses.

Exploits Exist

Fix Available

high

8.7

CVE-2026-44494

Axios vulnerable to full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Fix Available

high

8.6

CVE-2026-44492

Node.js's shouldBypassProxy function does not properly normalize IPv4-mapped IPv6 addresses, allowing bypass of NO_PROXY exclusions.

Fix Available

high

8.2

CVE-2026-27601

Underscore.js is vulnerable to a Denial of Service (DoS) attack due to unlimited recursion in _.flatten and _.isEqual functions.

Exploits Exist

Fix Available

high

8.2

GHSA-p92q-9vqr-4j8v

Axios is vulnerable to a Proxy-Authorization credential leak to the origin server across HTTP-to-HTTPS redirects in its Node.js HTTP adapter.

Fix Available

high

7.5

CVE-2025-58754

Axios is vulnerable to a denial-of-service (DoS) attack due to unbounded memory allocation when handling large 'data:' scheme URLs.

Exploits Exist

Fix Available

high

7.5

CVE-2026-25639

Axios is vulnerable to denial of service via a TypeError when processing configuration objects containing __proto__ as an own property.

Exploits Exist

Fix Available

high

7.5

CVE-2026-42038

Axios is vulnerable to a no_proxy bypass, allowing SSRF attacks due to incomplete hostname normalization.

Exploits Exist

Fix Available

ETHcode

SAFE Assessment

Compliance

Security

Threats

INCIDENTS FOR THIS VERSION:

Did you know...

ETHcode

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: This package had 1 malicious incident in versions published within 2 years prior to the latestLatest version with malware incident detected: about 1 year agoVersion: 0.5.0

INCIDENTS FOR THIS VERSION:

Did you know...