CVE-2025-4779

Katalog CVE

CVSS 6.1 · Medium EPSS 0,48%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada lunary. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthenticated attacker can inject malicious JavaScript into the `v1/runs/ingest` endpoint by adding an empty `citations` field, triggering a code path where `dangerouslySetInnerHTML` is used to render attacker-controlled text. This vulnerability allows the execution of arbitrary JavaScript in the context of the user's browser, potentially leading to session hijacking, data theft, or other malicious actions.

Rincian

Terbit di NVD

7 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lunary-ai/lunary/commit/18750294a76ff6c0f3f1b6af4ac1a23399836b16 patch
• https://huntr.com/bounties/c603b64e-5171-4eed-8983-a7f656ce2c4d exploit · patch · advisory pihak ketiga