MAL-2025-29585 Malicious code in prairie-gorilla-xzt593-project (npm)

The package prairie-gorilla-xzt593-project was found to contain malicious code...

MAL-2025-40956 Malicious code in zest-gorilla-x1gi (npm)

The package zest-gorilla-x1gi was found to contain malicious code...

MAL-2025-22919 Malicious code in icicle-gorilla-nav513-project (npm)

The package icicle-gorilla-nav513-project was found to contain malicious code...

MAL-2025-40831 Malicious code in zenith-gorilla-wze700-project (npm)

The package zenith-gorilla-wze700-project was found to contain malicious code...

MAL-2025-41106 Malicious code in zucchini-gorilla-hpot (npm)

The package zucchini-gorilla-hpot was found to contain malicious code...

MAL-2025-37087 Malicious code in tornado-gorilla-uxy824-project (npm)

The package tornado-gorilla-uxy824-project was found to contain malicious code...

MAL-2025-20372 Malicious code in fern-gorilla-mpy966-project (npm)

The package fern-gorilla-mpy966-project was found to contain malicious code...

MAL-2025-21763 Malicious code in gorilla-foxtrot-yqcj (npm)

The package gorilla-foxtrot-yqcj was found to contain malicious code...

MAL-2025-21765 Malicious code in gorilla-igloo-g838 (npm)

The package gorilla-igloo-g838 was found to contain malicious code...

Maintainers of Last Resort

Geomys is an organization of professional open source maintainers, focused on a portfolio of critical Go projects. For example, we are two thirds of the Go standard library cryptography maintainers, we provide the FIPS 140-3 validation of the upstream Go Cryptographic Module, and we fund the...

Linux Distros Unpatched Vulnerability : CVE-2024-37298

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running schema.Decoder.Decode on a struct that has a field of type struct... ope...

Debian: Security Advisory (DLA-4151-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian dla-4151 : golang-github-gorilla-csrf-dev - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4151 advisory. - -------------------------------------------------------------------------- Debian LTS Advisory DLA-4151-1 [email protected] https://www.debian.org/lts/security...

GO-2025-3607 gorilla/csrf CSRF vulnerability due to broken Referer validation in github.com/gorilla/csrf

gorilla/csrf CSRF vulnerability due to broken Referer validation in github.com/gorilla/csrf...

Cross-Site Request Forgery (CSRF)

github.com/gorilla/csrf is vulnerable to Cross Site Request Forgery CSRF. The vulnerability is due to improper origin validation caused by relying on the r.URL.Scheme field to detect TLS, which is not set for server requests, allowing an attacker with XSS on a related domain to perform...

SUSE CVE-2025-24358

gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...

DEBIAN-CVE-2025-24358

gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...

UBUNTU-CVE-2025-24358

gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...

CVE-2025-24358

gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...

CVE-2025-24358 gorilla/csrf CSRF vulnerability due to broken Referer validation

gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...