{"id":"GHSA-rwr8-xrpw-9qf5","aliases":[],"url":"https://o3.security/vulnerability/GHSA-rwr8-xrpw-9qf5","summary":"solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets","details":"### Summary\nThe latest versions of both 4.x and 5.x are using Axios versions < 1.7.5 and as such are subject to known vulnerabilities as per: https://security.snyk.io/package/npm/axios\n\n### Details\nWe've had this flagged up in a pen test, which indicates the issue stems from this script: /freeform/plugin.js. I couldn't see any reference to vulnerable axios versions in your package.json files, but noticed some precompiled files in packages/plugin so I'm assuming those are where the issue lies.","published":"2026-01-15T22:41:39Z","modified":"2026-02-03T03:17:27.081970Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"solspace/craft-freeform","fixedVersion":"4.1.22"},{"ecosystem":"Packagist","name":"solspace/craft-freeform","fixedVersion":"5.5.9"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/solspace/craft-freeform/security/advisories/GHSA-rwr8-xrpw-9qf5"},{"type":"PACKAGE","url":"https://github.com/solspace/craft-freeform"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-02-03T03:17:27.081970Z"}}