CVE-2025-5352

CVE-2025-5352 Une vulnérabilité de Cross-Site Scripting XSS stocké a été identifiée dans le composant Analytics de lunary-ai/lunary. Le problème provient du fait que la variable NEXTPUBLICCUSTOMSCRIPT est injectée directement dans le DOM à l'aide de dangerouslySetInnerHTML sans désinfection ni...

CVE-2025-5352

A critical stored Cross-Site Scripting XSS vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXTPUBLICCUSTOMSCRIPT environment variable is directly injected into the DOM using dangerouslySetInnerHTML without any sanitization or validation. This...

CVE-2025-5352: Improper Neutralization of Input During Web Page Generation

A critical stored Cross-Site Scripting XSS vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXTPUBLICCUSTOMSCRIPT environment variable is directly injected into the DOM using dangerouslySetInnerHTML without any sanitization or validation. This...