Vulnerabilities - CodeVista: AI Coding Assistant (FPT Internal) - Visual Studio Code

List of known vulnerabilities affecting the software package and the components it embeds. Last refreshed on: 2026/08/02

Hide triaged

CVSS Score

CVE Identifier

Summary

Tags

critical

10.0

CVE-2026-42043

Axios is vulnerable to a NO_PROXY protection bypass via RFC 1122 loopback subnet (127.0.0.0/8) due to an incomplete fix for CVE-2025-62718.

Exploits Exist

Fix Available

critical

9.1

CVE-2026-42044

Axios is vulnerable to a Prototype Pollution 'Gadget' attack that allows modification of JSON API responses.

Exploits Exist

Fix Available

high

8.8

CVE-2022-46175

JSON5's parse method is vulnerable to prototype pollution, allowing an attacker to set arbitrary keys on the resulting object.

Exploits Exist

Fix Available

high

8.7

CVE-2026-44494

Axios is vulnerable to a Prototype Pollution 'Gadget' attack, allowing Man-in-the-Middle attacks via config.proxy injection.

Exploits Exist

Fix Available

high

8.2

CVE-2026-44487

Axios's Node.js HTTP adapter may leak Proxy-Authorization credentials to the origin server during specific proxy-to-direct redirect flows.

Exploits Exist

Fix Available

high

7.7

CVE-2025-27152

axios is vulnerable to Server-Side Request Forgery (SSRF) and credential leakage when passing absolute URLs.

Exploits Exist

Fix Available

high

7.5

CVE-2022-24785

Moment.js is vulnerable to a path traversal vulnerability when a user-provided locale string is directly used to switch moment locale.

Exploited by Malware

Exploits Exist

Fix Available

high

7.5

CVE-2022-31129

Moment.js is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient parsing algorithm.

Exploits Exist

Fix Available

high

7.5

CVE-2024-39338

axios is vulnerable to Server-Side Request Forgery (SSRF) due to unexpected behavior with path relative URLs.

Exploits Exist

Fix Available

high

7.5

CVE-2025-58754

Axios is vulnerable to a denial-of-service (DoS) attack due to unbounded memory allocation when handling large 'data:' scheme URLs.

Exploits Exist

Fix Available

CodeVista: AI Coding Assistant (FPT Internal)

SAFE Assessment

Compliance

Security

Threats

Did you know...