Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
solspace/craft-freeform Exposed to Axios Security Flaw via Precompiled Assets
published 9 months ago
Summary
A security flaw in the Axios library, used by solspace/craft-freeform, could allow hackers to steal sensitive data. This issue affects precompiled assets in the plugin, which may not be properly updated. Update the plugin to the latest version to fix the issue.
What to do
- Update solspace craft-freeform to version 4.1.22.
- Update solspace craft-freeform to version 5.5.9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | solspace | craft-freeform |
< 4.1.22 >= 5.0.0-beta.1, < 5.5.9 Fix: upgrade to 4.1.22
|
Original advisory text
solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets
### Summary
The latest versions of both 4.x and 5.x are using Axios versions < 1.7.5 and as such are subject to known vulnerabilities as per: https://security.snyk.io/package/npm/axios
### Details
We've had this flagged up in a pen test, which indicates the issue stems from this script: /freeform/plugin.js. I couldn't see any reference to vulnerable axios versions in your package.json files, but noticed some precompiled files in packages/plugin so I'm assuming those are where the issue lies.
The latest versions of both 4.x and 5.x are using Axios versions < 1.7.5 and as such are subject to known vulnerabilities as per: https://security.snyk.io/package/npm/axios
### Details
We've had this flagged up in a pen test, which indicates the issue stems from this script: /freeform/plugin.js. I couldn't see any reference to vulnerable axios versions in your package.json files, but noticed some precompiled files in packages/plugin so I'm assuming those are where the issue lies.
Timeline
Published15 Jan 2026
Updated13 Mar 2026
First seen6 Mar 2026
Sources
GHSA-rwr8-xrpw-9qf5 · GHSA
Track software like this
Free during beta