We're currently using the latest version of the "Permission by Term" contrib module, and we noticed that it includes Axios v1.7.7 as a dependency. As you may be aware, this version has a known SSRF vulnerability (CVE-2025-27152) related to the allowAbsoluteUrls option.

To ensure continued security, we recommend upgrading to Axios v1.8.3 or later. If feasible, could you please update the dependency in the module or share any plans regarding this?

Happy to assist with testing or contribute a patch if needed.

Thanks for your work on this module!

Issue fork permissions_by_term-3529801

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

bhupendra_raykhere created an issue. See original summary.

vitaliyb98 made their first commit to this issue’s fork.

vitaliyb98 opened merge request !64

  • c9ab7ab5 committed on 3.1.x-dev 
    Issue #3529801 : Updated axios package to latest version.
jepster_’s picture

jepster_
Location 🇩🇪Düsseldorf
commented
Status: Active » Fixed

Thanks. Applied the MR and released in version 3.1.39: https://www.drupal.org/project/permissions_by_term/releases/3.1.39

Now that this issue is closed, please review the contribution record.

As a contributor, attribute any organization helped you, or if you volunteered your own time.

Maintainers, please credit people who helped resolve this issue.

  • b7ab7051 committed on 3.1.x-dev 
    [#3529801] feat: Updated axios package to latest version.

By:...
vitaliyb98’s picture

vitaliyb98 commented

@jepster_ Thanks for the review! I’d really appreciate it if you could assign credit to me.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.