solspace/craft-freeform · Security
solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets
- GHSA ID
- GHSA-rwr8-xrpw-9qf5
- Severity
- low
- Published
- Updated
Description
Summary
The latest versions of both 4.x and 5.x are using Axios versions < 1.7.5 and as such are subject to known vulnerabilities as per: https://security.snyk.io/package/npm/axios
Details
We've had this flagged up in a pen test, which indicates the issue stems from this script: /freeform/plugin.js. I couldn't see any reference to vulnerable axios versions in your package.json files, but noticed some precompiled files in packages/plugin so I'm assuming those are where the issue lies.