{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T05:50:07.631","vulnerabilities":[{"cve":{"id":"CVE-2025-4779","sourceIdentifier":"security@huntr.dev","published":"2025-07-07T10:15:28.717","lastModified":"2026-06-17T09:33:59.760","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthenticated attacker can inject malicious JavaScript into the `v1/runs/ingest` endpoint by adding an empty `citations` field, triggering a code path where `dangerouslySetInnerHTML` is used to render attacker-controlled text. This vulnerability allows the execution of arbitrary JavaScript in the context of the user's browser, potentially leading to session hijacking, data theft, or other malicious actions."},{"lang":"es","value":"Las versiones de lunary-ai/lunary anteriores a la 1.9.24 son vulnerables a cross site scripting (XSS) almacenado. Un atacante no autenticado puede inyectar JavaScript malicioso en el endpoint `v1/runs/ingest` añadiendo un campo `citations` vacío, lo que activa una ruta de código donde se usa `dangerouslySetInnerHTML` para renderizar texto controlado por el atacante. Esta vulnerabilidad permite la ejecución de JavaScript arbitrario en el contexto del navegador del usuario, lo que podría provocar secuestro de sesión, robo de datos u otras acciones maliciosas."}],"affected":[{"source":"security@huntr.dev","affectedData":[{"vendor":"lunary-ai","product":"lunary-ai/lunary","versions":[{"version":"unspecified","lessThan":"1.9.24","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV30":[{"source":"security@huntr.dev","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-07-07T17:23:49.466188Z","id":"CVE-2025-4779","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@huntr.dev","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:*","versionEndExcluding":"1.9.24","matchCriteriaId":"B3B8B17D-ABA8-4A7C-96FF-61FC3CA3C694"}]}]}],"references":[{"url":"https://github.com/lunary-ai/lunary/commit/18750294a76ff6c0f3f1b6af4ac1a23399836b16","source":"security@huntr.dev","tags":["Patch"]},{"url":"https://huntr.com/bounties/c603b64e-5171-4eed-8983-a7f656ce2c4d","source":"security@huntr.dev","tags":["Exploit","Patch","Third Party Advisory"]}]}}]}