JFrog: Where CVE Severity Scores Go Wrong

What it is

JFrog's analysis of a wave of 10 Axios prototype-pollution "gadget" CVEs disclosed since April 2026, all sharing one trait: they are only exploitable when a separate prototype pollution vulnerability already exists in the same JavaScript runtime. The centerpiece is CVE-2026-44494 (advisory GHSA-35jp-ww65-95wh), an Axios proxy-injection gadget, plus a passing look at CVE-2026-44490 (rated high by NVD).

Preconditions / Affected

For CVE-2026-44494 to be exploitable, the page states all of these must hold — several beyond what the advisory lists:

• The application uses a vulnerable Axios version.
• A prototype pollution condition exists in the same JavaScript runtime context.
• The pollution occurs before Axios processes/merges the request config.
• Object.prototype has been polluted with the proxy property.
• The user application must not override the polluted proxy property — a precondition JFrog found is not mentioned in the advisory.

flowchart TD
    A[Vulnerable Axios version] --> E{All met?}
    B[Separate proto-pollution bug] --> E
    C[Pollution before config merge] --> E
    D[App does not override proxy] --> E
    E -->|yes| X[Exploitable]
    E -->|no| N[Not exploitable]

The takeaway for triage: the Axios CVE alone is inert. Exploitability turns on whether your dependency tree also carries an exploitable prototype-pollution primitive — not on the Axios CVSS number.

How it works (PoC)

JFrog chained an old Lodash prototype-pollution bug (CVE-2019-10744) with the Axios proxy gadget. Lodash pollutes Object.prototype with a proxy value; Axios then inherits that proxy config and routes outbound requests through an attacker-controlled server, enabling credential theft.

The demo application had two endpoints:

• POST /config — updates config via Lodash's vulnerable defaultsDeep() (the pollution sink).
• GET /api/data — fetches from a backend using Axios with the now-polluted value.

The environment ran three components: a legitimate backend, the vulnerable app (Lodash + Axios), and an attacker "malicious proxy" returning a hijacked: true marker.

Caveats

The PoC's realism is self-limited: it required Lodash 4.17.11, a version released over seven years ago, to land the pollution primitive. The page notes such prerequisites "may appear theoretical." JFrog's broader claim — 96% of NVD critical and 65% of high CVEs they reassessed in 2025 warranted lower ratings — is their own reassessment, not an independent finding. The fetched text cuts off before the PoC's final exploitation stage, so the concrete exploit steps are not fully reproduced here.