PT-2025-34524 · Lunary Ai · Lunary

Published 2025-08-23 · Updated 2025-08-23 · CVE-2025-5352

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions up to 1.9.23

Description: A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component. The NEXT PUBLIC CUSTOM SCRIPT environment variable is directly injected into the DOM using dangerouslySetInnerHTML without sanitization or validation. This allows arbitrary JavaScript execution in all users' browsers if an attacker can control the environment variable during deployment or through server compromise. The vulnerability can lead to complete account takeover, data exfiltration, malware distribution, and persistent attacks affecting all users until the environment variable is cleaned.

Recommendations: lunary-ai/lunary versions prior to 1.9.25: Update to version 1.9.25 or later to address the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-5352

Affected Products

Lunary

References · 7

• https://github.com/lunary-ai/lunary/commit/e2e43e88cecf742bacb639ab880507bbfdfd065c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-5352 · Security Note
• https://huntr.com/bounties/f1d3dbce-3c3e-480e-b81e-0e8afa05c491 · Patch
• https://osv.dev/vulnerability/CVE-2025-5352 · Vendor Advisory
• https://t.me/CVEtracker/30781 · Telegram Post
• https://t.me/cveNotify/133259 · Telegram Post
• https://twitter.com/CVEnew/status/1959152150493155602 · Twitter Post