Go/github.com/gorilla/csrf CVE-2025-47909: high 7.3, EPSS 0.17%
github.com/gorilla/csrf improperly validates TrustedOrigins allowing CSRF attacks
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.7.3 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-82ff-hg59-8x73
- nvd: CVE-2025-47909
- https://github.com/golang/vulndb/issues/3884
- https://github.com/gorilla/csrf
- https://pkg.go.dev/vuln/GO-2025-3884
CVE-2025-47909 · published · modified · JSON