Read the docs
TI-2025-27743 Aliases CVE-2025-42616GHSA-cr8j-9qv8-5jph

CSRF vulnerability in CIRCL Vulnerability-Lookup

Priority LOW 32CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Tampering
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

Some endpoints in vulnerability-lookup that modified application state (e.g. changing database entries, user data, configurations, or other privileged actions) may have been accessible via HTTP GET requests without requiring a CSRF token. This flaw leaves the application vulnerable to Cross-Site Request Forgery (CSRF) attacks: an attacker who tricks a logged-in user into visiting a malicious website could cause the user’s browser to issue GET requests that perform unintended state-changing operations in the context of their authenticated session. Because the server would treat these GET requests as valid (since no CSRF protection or POST method enforcement was in place), the attacker could exploit this to escalate privileges, change settings, or carry out other unauthorized actions without needing the user’s explicit consent or awareness.  The fix ensures that all state-changing endpoints now require HTTP POST requests and include a valid CSRF token. This enforces that state changes cannot be triggered by arbitrary cross-site GET requests. This issue affects Vulnerability-Lookup: before 2.18.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00173 6th percentileScored 2026-11-07
Fix Fixed Vulnerability-Lookup (CIRCL): 2.18.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CIRCLVulnerability-Lookupbefore 2.18.02.18.0Patch availableCNA
  • Vulnerability-Lookup VendorCIRCL Affected before 2.18.0 Fixed in 2.18.0 Patch available CNA

Remediation

  • Fix · CNA Vulnerability-Lookup (CIRCL) Fixed in 2.18.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    CIRCL Vulnerability-Lookup 2.18.0

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2025-27744 CSRF vulnerability in CIRCL Vulnerability-LookupPriority LOW 36
    • TI-2025-27742 Improper Restriction of Excessive Authentication Attempts vulnerability in CIRCL Vulnerability-LookupPriority LOW 35
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-42616
  2. 2026-10-03 Alias added: GHSA-cr8j-9qv8-5jph

References

Advisory 1

  • TI-2021-20557 lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection… CVSS 3.1HIGH 7.5
  • TI-2026-28398 Stored XSS in modal item preview for long item content in AIL Framework CVSS 4.0HIGH 8.5
  • TI-2025-27744 CSRF vulnerability in CIRCL Vulnerability-Lookup CVSS 4.0HIGH 8.3
  • TI-2020-06847 Global.py in AIL framework 2.8 allows path traversal. CVSS 3.1HIGH 7.5
  • TI-2025-27742 Improper Restriction of Excessive Authentication Attempts vulnerability in CIRCL Vulnerability-Lookup CVSS 4.0HIGH 8.1
  • TI-2023-09040 workers/extractor.py in Pandora (aka pandora-analysis/pandora) 1.3.0 allows a denial of… CVSS 3.1MEDIUM 6.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences