Azure / Azure/azure-kusto-node
azure-kusto-data@7.1.0 pins vulnerable axios@1.4.0
- Dominant language
- TypeScript
- Stars
- 54
- Forks
- 46
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
`azure-kusto-data@7.1.0` pins its `axios` dependency to `1.4.0`, which is flagged by GitHub dependency review for multiple known vulnerabilities.
This appears to be a regression from `azure-kusto-data@7.0.4`, which depended on `axios` using the range `^1.8.4`. In `7.1.0`, the package metadata now lists:
```json
{
"axios": "1.4.0"
}
```
Because this is an exact transitive dependency, downstream consumers cannot update to `azure-kusto-data@7.1.0` without introducing vulnerable `axios@1.4.0`, unless they use package-manager overrides.
**To Reproduce**
Steps to reproduce the behavior:
1. Create or update a Node project that depends on `azure-kusto-data@7.1.0`.
2. Install dependencies with npm.
3. Inspect the installed dependency tree:
```bash
npm ls axios
npm view azure-kusto-data@7.1.0 dependencies --json
```
4. Run GitHub dependency review or another advisory scanner against the resulting lockfile.
Observed result: `azure-kusto-data@7.1.0` installs `axios@1.4.0`, which is flagged for multiple advisories.
Examples reported by GitHub dependency review:
- GHSA-8hc4-vh64-cxmj — Server-Side Request Forgery in axios
- GHSA-jr5f-v2jv-69x6 — SSRF / credential leakage via absolute URL
- GHSA-4hjh-wcwx-xvwj — DoS through lack of data size check
- GHSA-43fc-jf86-j433 — DoS via `__proto__` key in `mergeConfig`
- GHSA-wf5p-g6vw-rhxx — CSRF vulnerability
- GHSA-fvcv-3m26-pcqx — cloud metadata exfiltration via header injection chain
- GHSA-3p68-rc4w-qgx5 — `NO_PROXY` hostname normalization bypass leading to SSRF
**Expected behavior**
`azure-kusto-data` should depend on a patched axios version/range, ideally similar to or newer than the previous `^1.8.4` range used by `azure-kusto-data@7.0.4`.
For example, `azure-kusto-data@7.1.x` could depend on a patched axios range rather than the vulnerable exact version:
```json
{
"axios": "^1.8.4"
}
```
or another currently supported patched version.
**Screenshots**
N/A
**Setup (please complete the following information):**
- SDK Version: `azure-kusto-data@7.1.0`
- node version: N/A / reproducible from package metadata
- typescript version: N/A
**Browser Setup (please complete the following information):**
- framework: N/A
- server env: npm
- browser name/version: N/A
**Desktop (please complete the following information):**
- OS: N/A
- Version: N/A
**Additional context**
Package metadata comparison:
```bash
npm view azure-kusto-data@7.1.0 dependencies --json
```
shows:
```json
{
"axios": "1.4.0"
}
```
while:
```bash
npm view azure-kusto-data@7.0.4 dependencies --json
```
shows:
```json
{
"axios": "^1.8.4"
}
```
This blocks Dependabot updates for downstream repositories that enforce GitHub dependency review, because upgrading from `azure-kusto-data@7.0.4` to `7.1.0` introduces vulnerable `axios@1.4.0` into `package-lock.json`.
Contributor guide
Assessment
This issue has not been assessed yet.