[Aikido] Fix 7 security issues in axios, follow-redirects

[aikido-autofix]

Upgrading axios, follow-redirects to address vulnerabilities.

7 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

CVE ID	Severity	Description
CVE-2025-58754	HIGH	Axios is a promise based HTTP client for the browser and Node.js. When Axios prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a...
CVE-2023-45857	MEDIUM	An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
AIKIDO-2025-10185	MEDIUM	Affected versions of this package are vulnerable to server-side request forgery (SSRF) because allowAbsoluteUrls is not set to false by default when processing URLs in buildFullPath(). This unsafe default may lead to unintended URL acceptance, allowing attackers to bypass expected restrictions...
CVE-2025-27152	MEDIUM	axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impac
AIKIDO-2023-10001	LOW	Several security vulnerabilities were quietly patched in axios version 1.6.4 and version 0.29.0. Notably, a prototype pollution flaw impacted the formDataToJSON function, posing a significant risk. Additionally, a Regular Expression Denial of Service (ReDoS) vulnerability was identified and fixe...
CVE-2024-28849	MEDIUM	follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials...
CVE-2023-26159	MEDIUM	Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect...

🔗 Related Tasks

• https://kroo.atlassian.net/browse/CLOUD-898