andreglock/axios-ssrf

PoC

Demonstration of CVE-2025-27152

view exploit source poc_in_githubauthor andreglockpublished 2025-03-30catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2025-27152US	medium5.3	0.79% (56th)	Exploit	2025-03-07
axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set,…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.