2 matches found
CVE-2025-5352
A critical stored Cross-Site Scripting XSS vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXTPUBLICCUSTOMSCRIPT environment variable is directly injected into the DOM using dangerouslySetInnerHTML without any sanitization or validation. This...
9.6CVSS0.00497EPSS
SaveExploits1References2
CVE-2025-5352 Environment Variable XSS in Analytics Component in lunary-ai/lunary
A critical stored Cross-Site Scripting XSS vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXTPUBLICCUSTOMSCRIPT environment variable is directly injected into the DOM using dangerouslySetInnerHTML without any sanitization or validation. This...
8.1CVSS0.00497EPSS
SaveExploits1References2
20