CVE-2025-27152

MEDIUM

axios < 1.8.2 - Server-Side Request Forgery via Absolute URL Handling

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2025-27152. PoCs published by AikidoSec, adminlove520, andreglock.

AI-analyzed exploit summary This repository contains functional exploit PoCs for multiple CVEs, including a JavaScript injection vulnerability (AIKIDO-2026-10165) and a path traversal vulnerability (CVE-2014-3744). The PoCs demonstrate both vulnerable and protected scenarios using the Aikido Zen Firewall.

Description

axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.

Exploits (4)

github WORKING POC 6 stars
by AikidoSec · javascriptpoc
https://github.com/AikidoSec/zen-0-days/tree/main/node/CVE-2025-27152

This repository contains functional exploit PoCs for multiple CVEs, including a JavaScript injection vulnerability (AIKIDO-2026-10165) and a path traversal vulnerability (CVE-2014-3744). The PoCs demonstrate both vulnerable and protected scenarios using the Aikido Zen Firewall.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Node.js applications using @enspirit/elo and st modules
No auth needed
Prerequisites: Node.js environment · Docker for containerized testing
devstral-2 · analyzed Feb 27, 2026 Full analysis →
github WORKING POC 2 stars
by adminlove520 · pythonpoc
https://github.com/adminlove520/CVE-Poc_All_in_One/tree/main/2025/CVE-2025-27152

This repository contains functional exploit code for multiple CVEs, including authentication bypass vulnerabilities in TOTOLINK devices and a scanner for Fortinet SSL VPN (CVE-2024-21762). The PoCs demonstrate practical exploitation techniques with clear technical details.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: TOTOLINK LR350, TOTOLINK T6, Fortinet SSL VPN
No auth needed
Prerequisites: network access to target device
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 1 stars
by andreglock · poc
https://github.com/andreglock/axios-ssrf

This repository demonstrates a working PoC for CVE-2025-27152, showcasing SSRF via a vulnerable Axios version and path traversal in a NestJS backend. The README provides clear instructions for exploitation.

Classification
Working Poc 95%
Attack Type
Ssrf
Complexity
Trivial
Reliability
Reliable
Target: NestJS with vulnerable Axios version
No auth needed
Prerequisites: Access to the vulnerable endpoint · Network connectivity to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Vendor Advisory x_refsource_confirm
https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x6
Broken Link x_refsource_misc
https://github.com/axios/axios/issues/6463

Scores

CVSS v3 5.3
EPSS 0.0021
EPSS Percentile 44.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-918
Status published
Products (2)
axios/axios < 0.30.0
npm/axios 1.0.0 - 1.8.2npm
Published Mar 07, 2025
Tracked Since Feb 18, 2026