Bulmax9797-Sketch

**Name of the Vulnerable Software and Affected Versions** Axios versions 1.0.0 through 1.15.1 **Description** Axios is a promise-based HTTP client for the browser and Node.js. The HTTP adapter reads five configuration properties—`auth`, `baseURL`, `socketPath`, `beforeRedirect`, and `insecureHTTPParser`—via direct property access without using hasOwnProperty guards. This allows these properties to act as prototype pollution gadgets. If Object.prototype is polluted by another dependency within the same process, Axios will silently use these polluted values for every outbound HTTP request. Prototype pollution is a vulnerability where an attacker can manipulate the prototype of a base object, leading to the injection of properties into all objects inheriting from that prototype. **Recommendations** Update to version 1.15.2.

**Name of the Vulnerable Software and Affected Versions** SillyTavern versions prior to 1.17.0 **Description** SillyTavern is a locally installed user interface for interacting with text generation large language models, image generation engines, and text-to-speech voice models. A Server-Side Request Forgery (SSRF) issue exists in the `src/endpoints/search.js` file. The application uses a regular expression that only validates literal dotted-quad IPv4 addresses, failing to block `localhost`, IPv6 loopback addresses like `[::1]`, and DNS names that resolve to internal addresses. Exploitation is limited to services running on default ports 80 and 443 due to a port check on the `urlObj.port` variable. **Recommendations** Update to version 1.17.0.