The yonifre Lenix scss compiler contains a CSRF vulnerability identified as CVE-2025-60145, affecting versions up to 1.2. This vulnerability enables attackers to trick authenticated users into submitting unauthorized requests, potentially causing limited impact on the integrity of the application. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction. Confidentiality and availability impacts are not present, with only a low impact on integrity.

The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user due to the lack of proper CSRF protections. The impact is limited to a low integrity impact, with no direct confidentiality or availability consequences. No known exploits have been reported, and the vulnerability does not require privileges but does require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should consider implementing standard CSRF mitigations such as verifying CSRF tokens in requests or restricting actions to same-site contexts where possible. Monitor vendor communications for updates regarding patches or official mitigations.