axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config

#!/usr/bin/env python3
# check_axios_cve_2026_44494.py
# Detects axios exposure to CVE-2026-44494.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/error

import json
import os
import re
import sys
from typing import List, Optional, Tuple

AFFECTED_MIN = (1, 0, 0)
PATCHED = (1, 16, 0)


def parse_semver(version: str) -> Optional[Tuple[int, int, int]]:
    if not version:
        return None
    v = version.strip()
    v = re.sub(r'^[^0-9]+', '', v)  # drop ^ ~ >= <= v etc.
    m = re.match(r'^(\d+)\.(\d+)\.(\d+)', v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_is_vulnerable(version: str) -> Optional[bool]:
    sv = parse_semver(version)
    if sv is None:
        return None
    return AFFECTED_MIN <= sv < PATCHED


def collect_from_package_lock(obj, results: List[Tuple[str, str]]):
    if isinstance(obj, dict):
        if obj.get('name') == 'axios' and 'version' in obj:
            results.append(('lockfile', str(obj['version'])))
        packages = obj.get('packages')
        if isinstance(packages, dict):
            for path, meta in packages.items():
                if path.endswith('node_modules/axios') and isinstance(meta, dict) and 'version' in meta:
                    results.append((f'lockfile:{path}', str(meta['version'])))
        deps = obj.get('dependencies')
        if isinstance(deps, dict):
            for name, meta in deps.items():
                if name == 'axios' and isinstance(meta, dict) and 'version' in meta:
                    results.append(('lockfile:dependencies.axios', str(meta['version'])))
                collect_from_package_lock(meta, results)


def collect_from_package_json(obj, results: List[Tuple[str, str]]):
    if not isinstance(obj, dict):
        return
    for section in ('dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'):
        deps = obj.get(section)
        if isinstance(deps, dict) and 'axios' in deps:
            results.append((f'package.json:{section}', str(deps['axios'])))


def read_json(path: str):
    try:
        with open(path, 'r', encoding='utf-8') as f:
            return json.load(f)
    except Exception:
        return None


def find_versions(root: str) -> List[Tuple[str, str]]:
    results: List[Tuple[str, str]] = []

    for name in ('package-lock.json', 'npm-shrinkwrap.json'):
        p = os.path.join(root, name)
        if os.path.isfile(p):
            data = read_json(p)
            if data is not None:
                collect_from_package_lock(data, results)

    p = os.path.join(root, 'package.json')
    if os.path.isfile(p):
        data = read_json(p)
        if data is not None:
            collect_from_package_json(data, results)

    p = os.path.join(root, 'node_modules', 'axios', 'package.json')
    if os.path.isfile(p):
        data = read_json(p)
        if isinstance(data, dict) and 'version' in data:
            results.append(('node_modules/axios/package.json', str(data['version'])))

    # Deduplicate while preserving order
    seen = set()
    deduped = []
    for item in results:
        if item not in seen:
            deduped.append(item)
            seen.add(item)
    return deduped


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_axios_cve_2026_44494.py /path/to/app')
        sys.exit(3)

    root = sys.argv[1]
    if not os.path.isdir(root):
        print(f'UNKNOWN - path not found or not a directory: {root}')
        sys.exit(3)

    findings = find_versions(root)
    if not findings:
        print('UNKNOWN - axios version not found in package-lock.json, npm-shrinkwrap.json, package.json, or node_modules')
        sys.exit(2)

    vulnerable = []
    patched = []
    unknown = []

    for source, version in findings:
        verdict = version_is_vulnerable(version)
        if verdict is True:
            vulnerable.append((source, version))
        elif verdict is False:
            patched.append((source, version))
        else:
            unknown.append((source, version))

    if vulnerable:
        details = '; '.join([f'{src}={ver}' for src, ver in vulnerable])
        print(f'VULNERABLE - axios version(s) below 1.16.0 detected: {details}')
        sys.exit(1)

    if patched:
        details = '; '.join([f'{src}={ver}' for src, ver in patched])
        if unknown:
            details += ' | unresolved ranges: ' + '; '.join([f'{src}={ver}' for src, ver in unknown])
        print(f'PATCHED - no installed axios version below 1.16.0 found: {details}')
        sys.exit(0)

    details = '; '.join([f'{src}={ver}' for src, ver in unknown])
    print(f'UNKNOWN - axios referenced but version range could not be resolved automatically: {details}')
    sys.exit(2)


if __name__ == '__main__':
    main()