PT-2025-12308 · Lunary · Lunary

Published 2025-03-20 · Updated 2025-03-28 · CVE-2025-0281

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary versions 1.6.7 and earlier

Description A stored cross-site scripting (XSS) issue exists, allowing an attacker to inject malicious JavaScript into the SAML IdP XML metadata. This metadata is used to generate the SAML login redirect URL, which is then set as the value of window.location.href without proper validation or sanitization. This allows the attacker to execute arbitrary JavaScript in the context of the user's browser, potentially leading to session hijacking, data theft, or other malicious actions.

Recommendations For versions 1.6.7 and earlier, update to version 1.7.10 to resolve the issue. As a temporary workaround, consider validating and sanitizing the SAML login redirect URL to prevent malicious JavaScript execution. Restrict access to the SAML IdP XML metadata to minimize the risk of exploitation. Avoid using the window.location.href property with untrusted input until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-0281

Affected Products

Lunary

References · 9

• 🔥 https://huntr.com/bounties/b3f4a655-5b08-4fef-be2c-aac8703ad5d0 · Exploit
• https://github.com/lunary-ai/lunary/commit/fa0fd7742ae029ed934690d282519263f5d838de · Patch
• https://osv.dev/vulnerability/CVE-2025-0281 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0281 · Security Note
• https://t.me/cvetracker/19514 · Telegram Post
• https://t.me/cvedetector/20718 · Telegram Post
• https://t.me/latest_high_impact_cve/2010 · Telegram Post
• https://twitter.com/CVEnew/status/1902671076015894582 · Twitter Post
• https://twitter.com/dailycve/status/1905642829193392403 · Twitter Post