CVE-2025-5352

Katalog CVE

CVSS 9.6 · Critical EPSS 0,50%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada lunary. Skor CVSS 3.1 9.6 (Critical) menurut NVD.

Deskripsi (NVD)

A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXT_PUBLIC_CUSTOM_SCRIPT environment variable is directly injected into the DOM using dangerouslySetInnerHTML without any sanitization or validation. This allows arbitrary JavaScript execution in all users' browsers if an attacker can control the environment variable during deployment or through server compromise. The vulnerability can lead to complete account takeover, data exfiltration, malware distribution, and persistent attacks affecting all users until the environment variable is cleaned. The issue is fixed in version 1.9.25.

Rincian

Terbit di NVD

23 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.6 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 40,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lunary-ai/lunary/commit/e2e43e88cecf742bacb639ab880507bbfdfd065c patch
• https://huntr.com/bounties/f1d3dbce-3c3e-480e-b81e-0e8afa05c491 exploit · patch · advisory pihak ketiga