Security: Remediate CVE-2026-40175 — Upgrade axios to >= 1.15.0

[ryantruong-mantra]

Summary

CVE: CVE-2026-40175 | Severity: CRITICAL (CVSS 10.0) | Fix: axios >= 1.15.0

What is it?

axios is vulnerable to a "Gadget" attack chain. Prototype Pollution in any dependency can be escalated to RCE or full cloud compromise via AWS IMDSv2 bypass. Public PoC exists. Wiz flagged isHighProfileThreat: true and hasExploit: true.

Affected path

Detected in frontend/yarn.lock on branch mantra-cosmwasm — axios 1.6.5 via transitive deps.

Remediation

1. Run yarn why axios in the frontend/ directory to find all instances
2. Add a resolutions field to frontend/package.json:

   "resolutions": { "axios": ">=1.15.0" }

3. Run yarn install to regenerate the lock file
4. Confirm all versions resolve to >= 1.15.0
5. Open PR

References

• axios v1.15.0 Release Notes
• GHSA-fvcv-3m26-pcqx
• Wiz Findings