CVE-2023-45857

Axios Cross-Site Request Forgery Vulnerability

6.5 MediumPublic exploitFix available

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.73%Up 0.7 points since Nov 9, 2023

What each source reports

NVD Score used 6.5

Record: CVE-2023-45857
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-352
Updated: 2026-11-02

CVE List No score

Record: CVE-2023-45857
Updated: 2026-11-02

EUVDEUVD-2023-3051 No score

Record: EUVD-2023-3051
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wf5p-g6vw-rhxx 6.5

Axios Cross-Site Request Forgery Vulnerability

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Record: GHSA-wf5p-g6vw-rhxx
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-352
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-45857 6.5

Record: DEBIAN-CVE-2023-45857
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVGHSA-wf5p-g6vw-rhxx 6.5

Axios Cross-Site Request Forgery Vulnerability

Record: GHSA-wf5p-g6vw-rhxx
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-352
Updated: 2026-11-02

Show 12 moreShow less

OSVRHSA-2024:1640 7.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Record: RHSA-2024:1640
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-45857 6.5

Record: UBUNTU-CVE-2023-45857
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVCLSA-2026-1774225185 No score

TuxCare security update for axios (2 CVEs)

TuxCare rebuilt axios to address 2 CVEs. Fixed in 0.27.2-tuxcare.1.

Record: CLSA-2026-1774225185
Updated: 2026-11-02

OSVCLSA-2026-1774225186 No score

TuxCare security update for axios (5 CVEs)

TuxCare rebuilt axios to address 5 CVEs. Fixed in 0.18.1-tuxcare.1.

Record: CLSA-2026-1774225186
Updated: 2026-11-02

OSVCLSA-2026-1776991067 No score

TuxCare security update for axios (6 CVEs)

TuxCare rebuilt axios to address 6 CVEs. Fixed in 0.15.3-tuxcare.1.

Record: CLSA-2026-1776991067
Updated: 2026-11-02

OSVCLSA-2026-1782521951 No score

TuxCare security update for axios (17 CVEs)

TuxCare rebuilt axios to address 17 CVEs. Fixed in 0.19.2-tuxcare.1.

Record: CLSA-2026-1782521951
Updated: 2026-11-02

OSVCLSA-2026-1782781178 No score

TuxCare security update for axios (16 CVEs)

TuxCare rebuilt axios to address 16 CVEs. Fixed in 0.21.1-tuxcare.1.

Record: CLSA-2026-1782781178
Updated: 2026-11-02

OSVCLSA-2026-1782867613 No score

TuxCare security update for axios (15 CVEs)

TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.21.4-tuxcare.1.

Record: CLSA-2026-1782867613
Updated: 2026-11-02

OSVCLSA-2026-1783040460 No score

TuxCare security update for axios (15 CVEs)

TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.24.0-tuxcare.1.

Record: CLSA-2026-1783040460
Updated: 2026-11-02

OSVCLSA-2026-1783299714 No score

TuxCare security update for axios (15 CVEs)

TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.26.1-tuxcare.1.

Record: CLSA-2026-1783299714
Updated: 2026-11-02

OSVCLSA-2026-1784943156 No score

TuxCare security update for axios (1 CVE)

TuxCare rebuilt axios to address 1 CVE. Fixed in 0.26.0-tuxcare.1.

Record: CLSA-2026-1784943156
Updated: 2026-11-02

OSV No score

Record: CVE-2023-45857
Updated: 2026-11-02

Affected products

axios

Affected packages

Affected packages
Package	Affected	Fixed
`axios` npm	1.0.0 up to 1.6.0	1.6.0
`axios` npm	0.8.1 up to 0.28.0	0.28.0
`axios` TuxCare:npm From an advisory covering 2 CVEs	0.27.2-tuxcare.0 up to 0.27.2-tuxcare.1, plus listed versions 0.27.2	0.27.2-tuxcare.1
`axios` TuxCare:npm From an advisory covering 5 CVEs	0.18.1-tuxcare.0 up to 0.18.1-tuxcare.1, plus listed versions 0.18.1	0.18.1-tuxcare.1
`axios` TuxCare:npm From an advisory covering 6 CVEs	0.15.3-tuxcare.0 up to 0.15.3-tuxcare.1, plus listed versions 0.15.3	0.15.3-tuxcare.1
`axios` TuxCare:npm From an advisory covering 17 CVEs	0.19.2-tuxcare.0 up to 0.19.2-tuxcare.1, plus listed versions 0.19.2	0.19.2-tuxcare.1
`axios` TuxCare:npm From an advisory covering 16 CVEs	0.21.1-tuxcare.0 up to 0.21.1-tuxcare.1, plus listed versions 0.21.1	0.21.1-tuxcare.1
`axios` TuxCare:npm From an advisory covering 15 CVEs	0.21.4-tuxcare.0 up to 0.21.4-tuxcare.1, plus listed versions 0.21.4	0.21.4-tuxcare.1
`axios` TuxCare:npm From an advisory covering 15 CVEs	0.24.0-tuxcare.0 up to 0.24.0-tuxcare.1, plus listed versions 0.24.0	0.24.0-tuxcare.1
`axios` TuxCare:npm From an advisory covering 15 CVEs	0.26.1-tuxcare.0 up to 0.26.1-tuxcare.1, plus listed versions 0.26.1	0.26.1-tuxcare.1

Show 36 moreShow less

Affected packages
Package	Affected	Fixed
`axios` TuxCare:npm	0.26.0-tuxcare.0 up to 0.26.0-tuxcare.1, plus listed versions 0.26.0	0.26.0-tuxcare.1
`node-axios` Debian:12	before 1.2.1+dfsg-1+deb12u1, plus listed versions 1.2.1+dfsg-1	1.2.1+dfsg-1+deb12u1
`node-axios` Debian:13	before 1.6.2+dfsg-1	1.6.2+dfsg-1
`node-axios` Debian:14	before 1.6.2+dfsg-1	1.6.2+dfsg-1
`receptor` Red Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 12 CVEs	before 0:1.4.5-1.el8ap	0:1.4.5-1.el8ap
`receptorctl` Red Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 12 CVEs	before 0:1.4.5-1.el8ap	0:1.4.5-1.el8ap
`receptor` Red Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 12 CVEs	before 0:1.4.5-1.el8ap	0:1.4.5-1.el8ap
`receptorctl` Red Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 12 CVEs	before 0:1.4.5-1.el8ap	0:1.4.5-1.el8ap
`receptor` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 12 CVEs	before 0:1.4.5-1.el8ap	0:1.4.5-1.el8ap
`receptorctl` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 12 CVEs	before 0:1.4.5-1.el8ap	0:1.4.5-1.el8ap
`receptor` Red Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 12 CVEs	before 0:1.4.5-1.el9ap	0:1.4.5-1.el9ap
`receptorctl` Red Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 12 CVEs	before 0:1.4.5-1.el9ap	0:1.4.5-1.el9ap
`receptor` Red Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 12 CVEs	before 0:1.4.5-1.el9ap	0:1.4.5-1.el9ap
`receptorctl` Red Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 12 CVEs	before 0:1.4.5-1.el9ap	0:1.4.5-1.el9ap
`receptor` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 12 CVEs	before 0:1.4.5-1.el9ap	0:1.4.5-1.el9ap
`receptorctl` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 12 CVEs	before 0:1.4.5-1.el9ap	0:1.4.5-1.el9ap
`automation-controller-venv-tower` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 12 CVEs	before 0:4.5.5-2.el8ap	0:4.5.5-2.el8ap
`automation-controller-venv-tower` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 12 CVEs	before 0:4.5.5-2.el9ap	0:4.5.5-2.el9ap
`python39-aiohttp` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 12 CVEs	before 0:3.9.3-1.el8ap	0:3.9.3-1.el8ap
`python39-aiohttp-debuginfo` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 12 CVEs	before 0:3.9.3-1.el8ap	0:3.9.3-1.el8ap
`python3x-aiohttp` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 12 CVEs	before 0:3.9.3-1.el8ap	0:3.9.3-1.el8ap
`python3x-aiohttp-debugsource` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 12 CVEs	before 0:3.9.3-1.el8ap	0:3.9.3-1.el8ap
`python-aiohttp` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 12 CVEs	before 0:3.9.3-1.el9ap	0:3.9.3-1.el9ap
`python-aiohttp-debugsource` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 12 CVEs	before 0:3.9.3-1.el9ap	0:3.9.3-1.el9ap
`python3-aiohttp` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 12 CVEs	before 0:3.9.3-1.el9ap	0:3.9.3-1.el9ap
`python3-aiohttp-debuginfo` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 12 CVEs	before 0:3.9.3-1.el9ap	0:3.9.3-1.el9ap
`python39-django` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 12 CVEs	before 0:4.2.11-1.el8ap	0:4.2.11-1.el8ap
`python3x-django` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 12 CVEs	before 0:4.2.11-1.el8ap	0:4.2.11-1.el8ap
`python-django` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 12 CVEs	before 0:4.2.11-1.el9ap	0:4.2.11-1.el9ap
`python3-django` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 12 CVEs	before 0:4.2.11-1.el9ap	0:4.2.11-1.el9ap
`node-axios` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 0.19.0+dfsg-20.19.0+dfsg-2ubuntu0.1~esm1	None known
`node-axios` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 0.21.1+dfsg-10.23.0+dfsg-20.24.0+dfsg-10.25.0+dfsg-20.26.0+dfsg-10.26.0+dfsg-1ubuntu0.1~esm1	None known
`node-axios` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 1.2.1+dfsg-11.5.1+dfsg-11.6.2+dfsg-11.6.8+dfsg-21.6.8+dfsg-2ubuntu0.1~esm1	None known
`node-axios` Ubuntu:25.10	All versions, plus listed versions 1.7.9+dfsg-11.8.4+dfsg-11.11.0+dfsg-1	None known
`node-axios` Ubuntu:26.10	All versions, plus listed versions 1.13.2+dfsg-1build11.16.0-11.18.0-11.19.0-1	None known
`node-axios` Ubuntu:Pro:26.04:LTS	All versions, plus listed versions 1.11.0+dfsg-11.12.1+dfsg-11.13.2+dfsg-1build11.13.2+dfsg-1ubuntu0.1~esm1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	valentin-panov/CVE-2023-45857	2023-10-18
PoC in GitHub	intercept6/CVE-2023-45857-Demo	2023-10-26
PoC in GitHub	fuyuooumi1027/CVE-2023-45857-Demo	2023-11-24

History

History
Recorded	Changed	Sources
Nov 8, 2026	affected, aliases
Nov 6, 2026	affected, aliases
Nov 6, 2026	affected
Nov 6, 2026	affected, exploits, facts	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-45857 is a medium vulnerability (CVSS 6.5) in Axios, published November 8, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in axios 1.6.0.

References

Show 78 moreShow less