PT-2025-12242 · Unknown · Lunary-Ai/Lunary

Published 2025-03-20 · Updated 2025-07-02 · CVE-2024-8763

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version git be54057

Description A Regular Expression Denial of Service (ReDoS) issue exists in the compileTextTemplate function. This is due to the regular expression /{{(.*?)}}/g being susceptible to second-degree polynomial time complexity, which can be triggered by a large number of braces in the input. An attacker can exploit this by manipulating the regular expression, causing the server to hang indefinitely and become unresponsive to requests.

Recommendations For version git be54057, consider disabling the compileTextTemplate function until a patch is available to prevent exploitation of the ReDoS vulnerability. Restrict input to prevent a large number of braces from being processed by the vulnerable regular expression /{{(.*?)}}/g.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

CVE-2024-8763

Affected Products

Lunary-Ai/Lunary

References · 6

• 🔥 https://huntr.com/bounties/4fb63a6e-0056-4550-a34d-e161de1c13b8 · Exploit
• https://github.com/lunary-ai/lunary/commit/7ff89b0304d191534b924cf063f3648206d497fa · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-8763 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8763 · Vendor Advisory
• https://t.me/cvenotify/127490 · Telegram Post
• https://twitter.com/CVEnew/status/1903336835046072805 · Twitter Post