CRITICAL🇵🇱 Wersja polska

CVE-2025-5352

CVSS 9.6v3.1pub. 2025-08-23upd. 2025-11-26

A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXT_PUBLIC_CUSTOM_SCRIPT environment variable is directly injected into the DOM using dangerouslySetInnerHTML without any sanitization or validation. This allows arbitrary JavaScript execution in all users' browsers if an attacker can control the environment variable during deployment or through server compromise. The vulnerability can lead to complete account takeover, data exfiltration, malware distribution, and persistent attacks affecting all users until the environment variable is cleaned. The issue is fixed in version 1.9.25.

🤖 AI Analysis
How it works

The NEXT_PUBLIC_CUSTOM_SCRIPT environment variable is injected directly into the DOM using the dangerouslySetInnerHTML mechanism in React, which deliberately bypasses built-in XSS protections. An attacker who gains control over this environment variable during application deployment or as a result of server compromise can embed arbitrary JavaScript code. The malicious script is then executed in the browsers of all users visiting the application and remains active until the environment variable is cleared.

Impact

An attacker can cause complete account takeover, data exfiltration, distribution of malicious software, and conduct persistent attacks affecting all users of the application.

Mitigation & patch

Update Lunary to version 1.9.25, in which the issue has been fixed. Additionally, it is recommended to review and verify currently set environment variables for the presence of malicious scripts.

Who is affected

Lunary (lunary-ai/lunary) in versions up to and including 1.9.23

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

  • Lunary

    APP
    Lunary
    < 1.9.25
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2024-9095CRITICAL9.8PL ✓same product

Brak kontroli dostępu w API BigQuery — eksport całej bazy danych w Lunary

CVE-2024-7456CRITICAL9.8PL ✓same product

SQL Injection w trasie /api/v1/external-users aplikacji Lunary

CVE-2024-7475CRITICAL9.1PL ✓same product

Lunary: brak kontroli dostępu do konfiguracji SAML (nieautoryzowana zmiana)

CVE-2024-4146CRITICAL9.8PL ✓same product

Błąd autoryzacji w Lunary umożliwiający pełny dostęp do projektów

CVE-2024-5328CRITICAL9.3PL ✓same product

SSRF w Lunary – nieautoryzowane żądania przez endpoint SAML IdP