Snyk Security Database

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Prototype Pollution via the mergeDirectKeys function in mergeConfig. An attacker can force a request configuration to inherit attacker-controlled properties by supplying a polluted Object.prototype, causing Axios to read inherited values, such as validateStatus, during config merging. This lets a malicious page or library alter how responses are handled, including making 4xx and 5xx responses be treated as successful and bypassing normal error handling in applications that rely on Axios defaults.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to SQL Injection via the token lookup query in the combined view path. An attacker can extract or manipulate records by supplying a crafted token value that is interpolated directly into the WHERE v.token = '{token}' clause. This affects the proxy’s combined-view token resolution logic and can expose or alter tenant-scoped data returned by the database query.

Workarounds

• Set disable_error_logs: true under general_settings to prevent unauthenticated input from reaching the vulnerable proxy API key verification query path.

org.apache.kafka:kafka-clients is a streaming platform that can publish and subscribe to streams of records, store streams of records in a fault-tolerant durable way, and process streams of records as they occur.

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File. Kafka is vulnerable to the disclosure of sensitive information via the toString methods of IncrementalAlterConfigsRequest and AlterUserScramCredentialsRequest. An attacker can expose config values, SCRAM salts, and salted passwords by triggering request logging or any code path that renders these request objects as strings. This leaks administrative secrets and credential material into logs and diagnostics, allowing unauthorized readers of those logs to recover protected configuration values and authentication data.

Workarounds

• Keep Kafka clients at the default INFO log level and do not enable DEBUG logging for NetworkClient, so request and response objects are not rendered into logs, and sensitive config values, SCRAM salts, and salted passwords are not exposed.