Skip to content
OpenAdvisories
High · 8.1 Public exploit CVE-2025-5352 EUVD-2025-25632GHSA-6cxf-c9x7-g2q5

Environment Variable XSS in Analytics Component in lunary-ai/lunary

Published Aug 23, 2025 · Updated Aug 25, 2025 · Assigned by @huntr_ai

Vendor: lunary-ai Product: lunary-ai/lunary

Description

A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXT_PUBLIC_CUSTOM_SCRIPT environment variable is directly injected into the DOM using dangerouslySetInnerHTML without any sanitization or validation. This allows arbitrary JavaScript execution in all users' browsers if an attacker can control the environment variable during deployment or through server compromise. The vulnerability can lead to complete account takeover, data exfiltration, malware distribution, and persistent attacks affecting all users until the environment variable is cleaned. The issue is fixed in version 1.9.25.

Affected products

VendorProductAffectedFixed
lunary-ai lunary-ai/lunary unspecified – < 1.9.25 1.9.25

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • sahiloj/CVE-2025-5352 ★ 0 · Dec 5, 2025

    A stored XSS vulnerability exists in the Analytics component of lunary-ai/lunary where NEXT_PUBLIC_CUSTOM_SCRIPT is injected into the DOM using dangerouslySetInnerHTML without sanitization. An attack…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References