CVE-2024-5478

A Cross-site Scripting XSS vulnerability exists in the SAML metadata endpoint "/auth/saml/$org?.id/metadata" of lunary-ai/lunary version 1.2.7. The vulnerability arises due to the application's failure to escape or validate the "orgId" parameter supplied by the user before incorporating it into t...