Description
In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',href) call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability.
Remediation
References
Related Vulnerabilities
osCommerce Other Vulnerability (CVE-2004-2638)
Oracle Database Server CVE-2014-4237 Vulnerability (CVE-2014-4237)
Joomla! Core 1.0.x Multiple Cross-Site Scripting Vulnerabilities (1.0.0 - 1.0.10)
WordPress Plugin dsIDXpress IDX Cross-Site Scripting (2.1.0)
WordPress Plugin Block wp-login Cross-Site Request Forgery (1.3.0)