VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 21, 2026

kortix-ai suna Auth Endpoint page.tsx router.push cross site scripting

CVE-2026-12811

Description

A weakness has been identified in kortix-ai suna up to 0.8.38. Affected by this issue is the function router.replace/router.push of the file apps/frontend/src/app/auth/page.tsx of the component Auth Endpoint. Executing a manipulation of the argument returnURL can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.8.39 can resolve this issue. This patch is called f5dec7aa0c1b8fa0125938f292c0f2430ca75f6c. It is advisable to upgrade the affected component. The researcher explains: "The issue was fixed in v0.8.39 without notifying the wider user base via a security disclosure."

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Kortix AI/Sunainferred2 versions
    <=0.8.38+ 1 more
    • (no CPE)range: <=0.8.38
    • (no CPE)range: <=0.8.38

Patches

Vulnerability mechanics

Root cause

"Missing input validation on the returnUrl parameter allows a javascript: URI to be passed to router.replace/router.push, resulting in DOM-based XSS."

Attack vector

An attacker crafts a malicious link such as `https://HOST/auth/password?returnUrl=javascript:alert(document.cookie)` and sends it to a victim [ref_id=2]. When the authenticated victim clicks the link, the client-side code reads the unsanitized `returnUrl` from the URL query and passes it to `router.replace` or `router.push`, which in turn sets `window.location` to the `javascript:` URI [ref_id=2]. This executes arbitrary JavaScript in the context of the application's origin, enabling session hijacking, credential theft, or internal network pivoting [ref_id=2]. No authentication is required from the attacker, and the attack is launched remotely over the network [ref_id=2].

Affected code

The vulnerability resides in `apps/frontend/src/app/auth/page.tsx` and `apps/frontend/src/app/auth/password/page.tsx`. The `returnUrl` query parameter is read from the URL and passed directly to `router.replace` or `router.push` without sanitization, allowing a `javascript:` URI to be executed in the browser context [ref_id=2]. The patch introduces a `sanitizeAuthReturnUrl` helper that validates the return URL before it reaches any navigation sink [patch_id=6947853].

What the fix does

The patch replaces every occurrence of `formData.get('returnUrl') as string | undefined` with a call to `sanitizeAuthReturnUrl(...)` and removes the fallback `|| '/instances'` from the `emailRedirectTo` construction [patch_id=6947853]. The new helper function validates that the return URL is a safe path before it is used in any redirect or navigation. This prevents `javascript:`, `data:`, and other dangerous schemes from reaching `router.replace` or `router.push`, closing the XSS vector at the server action level rather than relying on client-side validation alone [ref_id=1].

Preconditions

  • authVictim must be authenticated to the Suna application.
  • inputVictim must click a crafted link containing a malicious returnUrl parameter.
  • networkAttack is launched remotely over HTTP/HTTPS.

Reproduction

1. Attacker crafts a URL such as `https://HOST/auth/password?returnUrl=javascript:alert(window.origin)`. 2. The attacker sends this link to an authenticated victim. 3. The victim clicks the link; the client-side code reads the unsanitized `returnUrl` and passes it to `router.replace` or `router.push`. 4. The browser executes the `javascript:` URI, running arbitrary JavaScript in the application's origin context [ref_id=2].

Generated on Jun 22, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.