PT-2025-12105 · Lunary · Lunary

Published

2025-03-20

·

Updated

2025-07-02

·

CVE-2024-11301

CVSS v3.1
6.5
VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions lunary-ai/lunary versions prior to 1.6.3
Description The application allows the creation of evaluators without enforcing a unique constraint on the combination of 
projectId
and 
slug
. This enables an attacker to overwrite existing data by submitting a POST request to the API endpoint with the same 
slug
as an existing evaluator. The lack of database constraints or application-layer validation to prevent duplicates exposes the application to data integrity issues, potentially resulting in corrupted data and malicious actions that impair the system's functionality.
Recommendations For versions prior to 1.6.3, update to version 1.6.3 or later to resolve the issue. As a temporary workaround, consider implementing custom validation to enforce unique constraints on the combination of 
projectId
and 
slug
for evaluator creation. Restrict access to the evaluator creation API endpoint to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-837

Related Identifiers

CVE-2024-11301

Affected Products

Lunary