What’s Vulnerable › Vulnerabilities

CVE-2025-4779: Stored Cross-site Scripting (XSS) in lunary-ai/lunary

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-07-07 · updated 2026-06-17
• Weakness: CWE-79

Description

lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthenticated attacker can inject malicious JavaScript into the `v1/runs/ingest` endpoint by adding an empty `citations` field, triggering a code path where `dangerouslySetInnerHTML` is used to render attacker-controlled text. This vulnerability allows the execution of arbitrary JavaScript in the context of the user's browser, potentially leading to session hijacking, data theft, or other malicious actions.

Affected products

• lunary-ai/lunary: before 1.9.24 — fixed in 1.9.24

How to fix

Upgrade to a fixed version: lunary-ai/lunary 1.9.24. Check the vendor advisory for mitigations.

References

• https://github.com/lunary-ai/lunary/commit/18750294a76ff6c0f3f1b6af4ac1a23399836b16
• https://huntr.com/bounties/c603b64e-5171-4eed-8983-a7f656ce2c4d

Get alerted when CVE-2025-4779 or the next vulnerability affects your stack