From 8fab1ee668464f728b0028d1afb1987d258f2de6 Mon Sep 17 00:00:00 2001
From: "Abdullah." <125115953+mabdullahabaid@users.noreply.github.com>
Date: Wed, 22 Oct 2025 20:15:52 +0500
Subject: [PATCH] fix: axios requests vulnerable to possible SSRF and
 credential leakage via absolute URL  (#15244)

Fixes [Dependabot Alert
211](https://github.com/twentyhq/twenty/security/dependabot/211) - axios
requests vulnerable to possible SSRF and credential leakage via absolute
URL.
---
 .../serverless/drivers/layers/1/package.json  |  2 +-
 .../serverless/drivers/layers/1/yarn.lock     | 36 +++++++++++++------
 2 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/packages/twenty-server/src/engine/core-modules/serverless/drivers/layers/1/package.json b/packages/twenty-server/src/engine/core-modules/serverless/drivers/layers/1/package.json
index 4b3c1193bc..082a9022d3 100644
--- a/packages/twenty-server/src/engine/core-modules/serverless/drivers/layers/1/package.json
+++ b/packages/twenty-server/src/engine/core-modules/serverless/drivers/layers/1/package.json
@@ -17,7 +17,7 @@
     "@types/lodash.upperfirst": "^4.3.9",
     "@types/uuid": "^10.0.0",
     "archiver": "^7.0.1",
-    "axios": "^1.7.5",
+    "axios": "^1.12.0",
     "bcrypt": "^5.1.1",
     "body-parser": "^1.20.3",
     "deep-equal": "^2.2.3",
diff --git a/packages/twenty-server/src/engine/core-modules/serverless/drivers/layers/1/yarn.lock b/packages/twenty-server/src/engine/core-modules/serverless/drivers/layers/1/yarn.lock
index b266b59fa2..f132d42783 100644
--- a/packages/twenty-server/src/engine/core-modules/serverless/drivers/layers/1/yarn.lock
+++ b/packages/twenty-server/src/engine/core-modules/serverless/drivers/layers/1/yarn.lock
@@ -607,14 +607,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"axios@npm:^1.7.5":
-  version: 1.7.5
-  resolution: "axios@npm:1.7.5"
+"axios@npm:^1.12.0":
+  version: 1.12.2
+  resolution: "axios@npm:1.12.2"
   dependencies:
     follow-redirects: "npm:^1.15.6"
-    form-data: "npm:^4.0.0"
+    form-data: "npm:^4.0.4"
     proxy-from-env: "npm:^1.1.0"
-  checksum: 10c0/1d5daeb28b3d1bb2a7b9f0743433c4bfbeaddc15461e50ebde487eec6c009af2515749d5261096dd430c90cd891bd310bcba5ec3967bae2033c4a307f58a6ad3
+  checksum: 10c0/80b063e318cf05cd33a4d991cea0162f3573481946f9129efb7766f38fde4c061c34f41a93a9f9521f02b7c9565ccbc197c099b0186543ac84a24580017adfed
   languageName: node
   linkType: hard
 
@@ -1185,6 +1185,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"es-set-tostringtag@npm:^2.1.0":
+  version: 2.1.0
+  resolution: "es-set-tostringtag@npm:2.1.0"
+  dependencies:
+    es-errors: "npm:^1.3.0"
+    get-intrinsic: "npm:^1.2.6"
+    has-tostringtag: "npm:^1.0.2"
+    hasown: "npm:^2.0.2"
+  checksum: 10c0/ef2ca9ce49afe3931cb32e35da4dcb6d86ab02592cfc2ce3e49ced199d9d0bb5085fc7e73e06312213765f5efa47cc1df553a6a5154584b21448e9fb8355b1af
+  languageName: node
+  linkType: hard
+
 "event-target-shim@npm:^5.0.0":
   version: 5.0.1
   resolution: "event-target-shim@npm:5.0.1"
@@ -1256,14 +1268,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"form-data@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "form-data@npm:4.0.0"
+"form-data@npm:^4.0.4":
+  version: 4.0.4
+  resolution: "form-data@npm:4.0.4"
   dependencies:
     asynckit: "npm:^0.4.0"
     combined-stream: "npm:^1.0.8"
+    es-set-tostringtag: "npm:^2.1.0"
+    hasown: "npm:^2.0.2"
     mime-types: "npm:^2.1.12"
-  checksum: 10c0/cb6f3ac49180be03ff07ba3ff125f9eba2ff0b277fb33c7fc47569fc5e616882c5b1c69b9904c4c4187e97dd0419dd03b134174756f296dec62041e6527e2c6e
+  checksum: 10c0/373525a9a034b9d57073e55eab79e501a714ffac02e7a9b01be1c820780652b16e4101819785e1e18f8d98f0aee866cc654d660a435c378e16a72f2e7cac9695
   languageName: node
   linkType: hard
 
@@ -1343,7 +1357,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"get-intrinsic@npm:^1.2.5, get-intrinsic@npm:^1.3.0":
+"get-intrinsic@npm:^1.2.5, get-intrinsic@npm:^1.2.6, get-intrinsic@npm:^1.3.0":
   version: 1.3.1
   resolution: "get-intrinsic@npm:1.3.1"
   dependencies:
@@ -2648,7 +2662,7 @@ __metadata:
     "@types/lodash.upperfirst": "npm:^4.3.9"
     "@types/uuid": "npm:^10.0.0"
     archiver: "npm:^7.0.1"
-    axios: "npm:^1.7.5"
+    axios: "npm:^1.12.0"
     bcrypt: "npm:^5.1.1"
     body-parser: "npm:^1.20.3"
     deep-equal: "npm:^2.2.3"