| Package | Affected versions | Patched versions |
|---|---|---|
| solspace/craft-freeform | ≥ 5.0.0-beta.1, < 5.5.9< 4.1.22 | 5.5.94.1.22 |
The latest versions of both 4.x and 5.x are using Axios versions < 1.7.5 and as such are subject to known vulnerabilities as per: https://security.snyk.io/package/npm/axios
We've had this flagged up in a pen test, which indicates the issue stems from this script: /freeform/plugin.js. I couldn't see any reference to vulnerable axios versions in your package.json files, but noticed some precompiled files in packages/plugin so I'm assuming those are where the issue lies.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free