What’s Vulnerable › Vulnerabilities

CVE-2025-5352: Environment Variable XSS in Analytics Component in lunary-ai/lunary

• Severity: critical (CVSS 9.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-08-23 · updated 2026-06-17
• Weakness: CWE-79

Description

A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXT_PUBLIC_CUSTOM_SCRIPT environment variable is directly injected into the DOM using dangerouslySetInnerHTML without any sanitization or validation. This allows arbitrary JavaScript execution in all users' browsers if an attacker can control the environment variable during deployment or through server compromise. The vulnerability can lead to complete account takeover, data exfiltration, malware distribution, and persistent attacks affecting all users until the environment variable is cleaned. The issue is fixed in version 1.9.25.

Affected products

• lunary-ai/lunary: before 1.9.25 — fixed in 1.9.25

How to fix

Upgrade to a fixed version: lunary-ai/lunary 1.9.25. Check the vendor advisory for mitigations.

References

• https://github.com/lunary-ai/lunary/commit/e2e43e88cecf742bacb639ab880507bbfdfd065c
• https://huntr.com/bounties/f1d3dbce-3c3e-480e-b81e-0e8afa05c491

Get alerted when CVE-2025-5352 or the next vulnerability affects your stack