GHSA-RWR8-XRPW-9QF5

The Ghost in the Minified Blob: Unpacking GHSA-RWR8-XRPW-9QF5 in Craft Freeform

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 16, 2026·5 min read·0 visits

Executive Summary (TL;DR)

Your `composer.json` might say you are safe, but your `/vendor` directory tells a different story. Solspace Freeform bundled a pre-compiled version of Axios (< 1.7.5) susceptible to SSRF and Redirect Bypasses directly into its frontend assets. Fixing it requires updating to Freeform 4.1.30 or 5.14.6, where the vendor finally recompiled the assets with a patched library.

Solspace Freeform for Craft CMS was found distributing precompiled JavaScript assets containing an outdated and vulnerable version of the Axios library. This supply-chain issue exposes applications to known flaws like CVE-2024-39338 (SSRF/Redirect Bypass) despite 'composer.json' potentially looking clean.

Technical Appendix

CVSS Score
7.5/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS Probability
0.20%
Top 99% most exploited

Affected Systems

Craft CMS 4.x with Freeform < 4.1.30Craft CMS 5.x with Freeform < 5.14.6

Affected Versions Detail

Product
Affected Versions
Fixed Version
solspace/craft-freeform
Solspace
< 4.1.304.1.30
solspace/craft-freeform
Solspace
< 5.14.65.14.6
AttributeDetail
Vulnerability TypeBundled Vulnerable Dependency
ComponentAxios Library (embedded in plugin.js)
Underlying CVECVE-2024-39338
Attack VectorNetwork (Client-side)
Exploit StatusPoC Available (for underlying Axios vuln)
ImpactSSRF / Security Control Bypass
CWE-1395
Dependency on Vulnerable Third-Party Component

The product uses a third-party component (Axios) that contains known vulnerabilities, but the component is bundled in a way that makes standard updates impossible.

Vulnerability Timeline

Axios 1.7.5 released, fixing CVE-2024-39338
2024-08-01
Solspace releases Freeform 4.1.30 and 5.14.6 with patched assets
2026-01-15
GHSA-RWR8-XRPW-9QF5 Published
2026-01-15

Subscribe to updates

Get the latest CVE analysis reports delivered to your inbox.