by Kastro
Paper/Archive/CVE-2025-4779

CVE-2025-4779

lunary-ai lunary-ai/lunary — Stored Cross-site Scripting (XSS) in lunary-ai/lunary

EPSS 0.5%public exploitCVSS 9.1
critical.is priorityof 100
46
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 41.5.415 × 208.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthenticated attacker can inject malicious JavaScript into the `v1/runs/ingest` endpoint by adding an empty `citations` field, triggering a code path where `dangerouslySetInnerHTML` is used to render attacker-controlled text. This vulnerability allows the execution of arbitrary JavaScript in the context of the user's browser, potentially leading to session hijacking, data theft, or other malicious actions.

Affected

ProductAffectedFixed inSource
lunary-ai/lunaryunspecified – < 1.9.241.9.24CNA

Scores by source

@huntr_ai (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refhuntr.com/bounties/c603b64e-5171-4eed-8983-a7f656ce2c4drefgithub.com/lunary-ai/lunary/commit/18750294a76ff6c0f3f1b6af4ac1a23399836b16