GHSA-rwr8-xrpw-9qf5 solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets
The plugin bundles vulnerable Axios versions, potentially allowing attackers to exploit known flaws in the underlying library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-rwr8-xrpw-9qf5?
GHSA-rwr8-xrpw-9qf5 is a vulnerability in solspace/craft-freeform, published on 15 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
The latest versions of both 4.x and 5.x are using Axios versions < 1.7.5 and as such are subject to known vulnerabilities as per: https://security.snyk.io/package/npm/axios
Details
We've had this flagged up in a pen test, which indicates the issue stems from this script: /freeform/plugin.js. I couldn't see any reference to vulnerable axios versions in your package.json files, but noticed some precompiled files in packages/plugin so I'm assuming those are where the issue lies.
Which versions are affected by GHSA-rwr8-xrpw-9qf5?
4 open source packages ship an affected version, including solspace/craft-freeform.
| Package | Affected | Fixed in |
|---|---|---|
solspace/craft-freeform Packagist | All versions | 4.1.22 |
solspace/craft-freeform Packagist | All versions | 4.1.22 |
solspace/craft-freeform Packagist | From 5.0.0-beta.1 | 5.5.9 |
solspace/craft-freeform Packagist | From 5.0.0-beta.1 | 5.5.9 |
How do I fix GHSA-rwr8-xrpw-9qf5?
Upgrade solspace/craft-freeform to a fixed version for your release line: 4.1.22 or 5.5.9.
Is GHSA-rwr8-xrpw-9qf5 being exploited?
There is no known exploitation of GHSA-rwr8-xrpw-9qf5 in the wild and no public exploit code.