CVE-2025-42616: CSRF in Vulnerability-Lookup

The primary impact of this CSRF vulnerability lies in the potential for unauthorized modification of application state. An attacker could leverage this flaw to alter database entries, user data, or configurations within Vulnerability-Lookup. Successful exploitation requires the attacker to trick a logged-in user into visiting a malicious website or clicking a crafted link. The attacker's GET request, originating from the user's browser within their authenticated session, would be treated as legitimate by the server, leading to unintended consequences. This could result in data breaches, privilege escalation, or disruption of service, depending on the specific actions accessible via the vulnerable GET endpoints.

1. Reserved2025-04-16
2. Published2025-12-08
3. EPSS updated2026-03-23

The recommended mitigation for CVE-2025-42616 is to immediately upgrade Vulnerability-Lookup to version 2.18.0 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as adding CSRF tokens to all state-changing GET requests. Web Application Firewalls (WAFs) configured to detect and block suspicious GET requests originating from untrusted sources can also provide a layer of protection. Review all GET requests that modify application state and ensure proper CSRF protection is in place. After upgrade, confirm by attempting to trigger a state-changing action via a GET request from an unauthenticated session; it should be rejected.