Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin header is checked with sameOrigin against a synthetic URL. However, if a host is added to TrustedOrigins, both its HTTP and HTTPS origins will be allowed, because the schema of the synthetic URL is ignored and only the host is checked. For example, if an application is hosted on https://example.com and adds example.net to TrustedOrigins, a network attacker can serve a form at http://example.net to perform the attack. Applications should migrate to net/http.CrossOriginProtection, introduced in Go 1.25. If that is not an option, a backport is available as a module at filippo.io/csrf, and a drop-in replacement for the github.com/gorilla/csrf API is available at filippo.io/csrf/gorilla.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing
    network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form
    at http://example.com can't get it to submit to https://example.com because the Origin header is checked
    with sameOrigin against a synthetic URL. However, if a host is added to TrustedOrigins, both its HTTP and
    HTTPS origins will be allowed, because the schema of the synthetic URL is ignored and only the host is
    checked. For example, if an application is hosted on https://example.com and adds example.net to
    TrustedOrigins, a network attacker can serve a form at http://example.net to perform the attack.
    Applications should migrate to net/http.CrossOriginProtection, introduced in Go 1.25. If that is not an
    option, a backport is available as a module at filippo.io/csrf, and a drop-in replacement for the
    github.com/gorilla/csrf API is available at filippo.io/csrf/gorilla. (CVE-2025-47909)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing     network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form     at http://example.com can't get it to submit to https://example.com because the Origin header is checked     with sameOrigin against a synthetic URL. However, if a host is added to TrustedOrigins, both its HTTP and     HTTPS origins will be allowed, because the schema of the synthetic URL is ignored and only the host is     checked. For example, if an application is hosted on https://example.com and adds example.net to     TrustedOrigins, a network attacker can serve a form at http://example.net to perform the attack.
    Applications should migrate to net/http.CrossOriginProtection, introduced in Go 1.25. If that is not an     option, a backport is available as a module at filippo.io/csrf, and a drop-in replacement for the     github.com/gorilla/csrf API is available at filippo.io/csrf/gorilla. (CVE-2025-47909)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
455300	Echo: github.com/gorilla/csrf: security update to 1.7.3	Tenable Cloud Security	Echo Local Security Checks	Local	medium
455300	Echo: github.com/gorilla/csrf: security update to 1.7.3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
261199	Linux Distros Unpatched Vulnerability : CVE-2025-47909	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2025-47909

medium

Tenable Plugins

medium

medium

high