Listen to this Post
The Craft Freeform plugin includes precompiled JavaScript assets, specifically /freeform/plugin.js, that bundle older, vulnerable versions of the Axios HTTP client library (versions <1.7.5). These outdated dependencies are not listed in the project’s main `package.json` but are embedded within the distributed plugin files. When the plugin runs, it uses this vulnerable Axios code to make HTTP requests. Known security flaws in these old Axios versions can then be exploited through the plugin’s functionality. For instance, if Axios contains an open redirect vulnerability, an attacker could manipulate request parameters to redirect sensitive data to a malicious site. The vulnerability is present because the plugin’s build process packages a fixed, insecure version of Axios, rather than dynamically using a secure version from the project’s dependencies. This creates an indirect supply chain attack vector where the secure parent application is compromised by the plugin’s insecure sub-dependency.
Platform: solspace/craft-freeform
Version: <4.1.22, <5.5.9
Vulnerability: Axios vuln exposure
Severity: Low
date: Jan 15, 2026
Prediction: Patched in 4.1.22/5.5.9
What Undercode Say:
Check for vulnerable precompiled plugin.js
find . -name "plugin.js" -path "freeform" -exec grep -l "axios" {} \;
Scan for axios version in bundled code
grep -r "axios" ./vendor/solspace/craft-freeform/ --include=".js"
Example to check version pattern
curl -s https://security.snyk.io/package/npm/axios | grep -o 'version [0-9.]'
How Exploit:
Attackers exploit known Axios flaws (e.g., CVE-2023-45857 open redirect) by crafting malicious inputs to HTTP requests made via the Freeform plugin, potentially hijacking redirects or stealing data.
Protection from this CVE
Update plugin to versions 4.1.22 or 5.5.9, which bundle patched Axios (>=1.7.5). Manually audit and rebuild any custom assets.
Impact:
Low severity risk of open redirects or request manipulation via vulnerable sub-dependency; requires interaction with plugin’s HTTP calls.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
