Medium severity6.1NVD Advisory· Published Jul 7, 2025· Updated Jun 17, 2026
CVE-2025-4779
CVE-2025-4779
Description
lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthenticated attacker can inject malicious JavaScript into the v1/runs/ingest endpoint by adding an empty citations field, triggering a code path where dangerouslySetInnerHTML is used to render attacker-controlled text. This vulnerability allows the execution of arbitrary JavaScript in the context of the user's browser, potentially leading to session hijacking, data theft, or other malicious actions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Patches
Vulnerability mechanics
References
2- github.com/lunary-ai/lunary/commit/18750294a76ff6c0f3f1b6af4ac1a23399836b16nvdPatch
- huntr.com/bounties/c603b64e-5171-4eed-8983-a7f656ce2c4dnvdExploitPatchThird Party Advisory
News mentions
0No linked articles in our index yet.