CVE-2025-5352 - Environment Variable XSS in Analytics Component in lunary-ai/lunary

Back Back to CVE browser

CRITICAL

Environment Variable XSS in Analytics Component in lunary-ai/lunary

Published Aug 23, 2025

9.6

CRITICAL

CVSS 3.1

EPSS 0.50%

Description

A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXT_PUBLIC_CUSTOM_SCRIPT environment variable is directly injected into the DOM using dangerouslySetInnerHTML without any sanitization or validation. This allows arbitrary JavaScript execution in all users' browsers if an attacker can control the environment variable during deployment or through server compromise. The vulnerability can lead to complete account takeover, data exfiltration, malware distribution, and persistent attacks affecting all users until the environment variable is cleaned. The issue is fixed in version 1.9.25.

Affected products

Vendor Lunary-AI Product Lunary-Ai/lunary Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <1.9.25

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Lunary-AI

Lunary-Ai/lunary

n/a

Version	Status	Constraints
unspecified	affected	<1.9.25

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://github.com/lunary-ai/lunary/commit/e2e43e88cecf742bacb639ab880507bbfdfd065c
Patch
https://huntr.com/bounties/f1d3dbce-3c3e-480e-b81e-0e8afa05c491
ExploitPatchThird Party Advisory

Link	Providers	Tags
https://github.com/lunary-ai/lunary/commit/e2e43e88cecf742bacb639ab880507bbfdfd065c		Patch
https://huntr.com/bounties/f1d3dbce-3c3e-480e-b81e-0e8afa05c491		ExploitPatchThird Party Advisory