[bug] Security Vulnerability in @reown/appkit-adapter-ethers transitive dependency (axios)

[JoseMariani]

Link to minimal reproducible example

npm warning

Steps to Reproduce

Hi Reown team,

I wanted to flag a security vulnerability introduced through a transitive dependency in @reown/appkit-adapter-ethers@1.8.23.

Dependency chain:

@reown/appkit-adapter-ethers@1.8.23 └── @reown/appkit-utils@1.8.23 └── @base-org/account@2.4.0 └── @coinbase/cdp-sdk@1.55.0 └── axios@1.x (vulnerable)
Reported vulnerabilities in axios (1.0.0 – 1.17.0):

GHSA-42h9-826w-cgv3 – Excessive recursion in formDataToJSON (DoS)
GHSA-xj6q-8x83-jv6g – Prototype pollution via auth subfields (Basic auth injection)
GHSA-pmv8-rq9r-6j72 – Deep formToJSON key recursion (DoS)
GHSA-hcpx-6fm6-wx23 – Axios form serializer maxDepth bypass
GHSA-7q8q-rj6j-mhjq – Nested axios option objects consuming polluted prototype values
GHSA-mwf2-3pr3-8698 – HTTP/2 streamed uploads bypass maxBodyLength
This causes npm audit to report 1 high and 1 moderate severity vulnerability for any project using @reown/appkit-adapter-ethers, even when axios is not a direct dependency of the consuming project.

Could you please update @base-org/account to a version that depends on axios >=1.8.0, or alternatively pin axios to a safe version within your package?

Thanks for your attention to this.

Summary

npm warning in npm install for transitive dependency

List of related npm package versions

"@reown/appkit": "^1.8.23",
"@reown/appkit-adapter-ethers": "^1.8.23",

Node.js Version

v22.17.1

Package Manager

10.9.2

[linear]

REOWN-4796

[linear]

from santiago:

Thanks for the detailed report and for tracing the exact chain.

We looked into this, and this is not something Reown can actually fix.

@base-org/account depends on @coinbase/cdp-sdk, and @coinbase/cdp-sdk hard-pins an exact axios version (currently 1.16.0) even at its latest published release. Bumping @base-org/account to its newest version, as suggested in the original report, does not help, the pin at the bottom of the chain stays vulnerable no matter which version of @base-org/account you resolve to, because none of its releases have moved past that pinned cdp-sdk dependency.

We also evaluated whether Reown could work around this on our end, for example by adding a pnpm.overrides (or the npm overrides / yarn resolutions equivalent) inside the appkit repository to force a safe axios version. That would only affect installs run at the root of the appkit monorepo itself: our own contributors, our own CI. It would have zero effect on your project. These override mechanisms are only ever read from the root of whatever project is actually running the install; they are never published as part of a package's own manifest, and no package manager propagates them through a dependency chain. So even if we added that override and cut a new appkit release, your own npm install would still resolve @base-org/account to the same vulnerable cdp-sdk to the same pinned axios, completely unaffected by anything we changed. Publishing that as if it fixed the issue would be misleading, so we are not doing it.

The only change that actually removes this vulnerability from your dependency tree is inside @coinbase/cdp-sdk itself. That is already tracked upstream:

• Issue: Security: axios pin 1.16.0 has 10 published advisories; fix PR #693 awaiting review since May coinbase/cdp-sdk#776
• Fix PR (open since May, rebased onto current main, passing their build, still awaiting review): fix: loosen axios pin to ^1.18.0 in typescript SDK coinbase/cdp-sdk#693

We encourage you to follow and apply pressure there, since that is the only place this can be resolved for everyone at once, including us.

If you want to silence this in your own npm audit before that PR merges, the only working option today is to add the same override yourself, in your own project's root package.json:

"overrides": {
  "@coinbase/cdp-sdk": {
    "axios": ">=1.18.0"
  }
}