fix: bump axios to ^1.15.0 to address CVE-2026-40175 - #7226
Conversation
Axios prior to 1.15.0 is vulnerable to a Prototype Pollution escalation that can lead to Remote Code Execution. Bumps direct dependencies and adds a root override to ensure all transitive copies are also updated.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The root override does not cascade to nested packages with their own independent lockfiles. Adds axios ^1.15.0 override to each federated module package. Affected packages: - packages/gen-ai/frontend - packages/model-registry/upstream/frontend
dpanshug
left a comment
dpanshug
left a comment
There was a problem hiding this comment.
/lgtm Tested running locally on 2.25 cluster
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dpanshug, manaswinidas The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
98cf02e
into
opendatahub-io:stable-2.x
fix: bump axios to ^1.15.0 to address CVE-2026-40175 (opendatahub-io#7226)
3 participants
Axios prior to 1.15.0 is vulnerable to a Prototype Pollution escalation that can lead to Remote Code Execution. Bumps direct dependencies and adds a root override to ensure all transitive copies are also updated.
Summary
axiosfrom^1.12.0to^1.15.0infrontendandpackages/contract-teststofix CVE-2026-40175
axios: ^1.15.0override in rootpackage.jsonto ensure transitive dependencies(
@module-federation/dts-plugin,wait-on) also resolve to the fixed versionCVE Details
allows Prototype Pollution in any third-party dependency to be escalated into Remote Code
Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass)