CVE-2025-4779: Lunary Stored XSS Vulnerability

CVE-2025-4779 Overview

CVE-2025-4779 is a stored cross-site scripting (XSS) vulnerability affecting lunary-ai/lunary versions prior to 1.9.24. An unauthenticated attacker can inject malicious JavaScript into the v1/runs/ingest endpoint by supplying an empty citations field. The payload reaches a code path where dangerouslySetInnerHTML renders attacker-controlled text without sanitization. When a user views the affected data, the injected script executes in the browser context. This can enable session hijacking, credential theft, and unauthorized actions performed on behalf of the victim.

Critical Impact
Unauthenticated attackers can store arbitrary JavaScript that executes in authenticated users' browsers, leading to session hijacking and data theft.

Affected Products

Lunary AI lunary versions prior to 1.9.24
Self-hosted Lunary deployments exposing the v1/runs/ingest endpoint
Web dashboards rendering ingested run data with dangerouslySetInnerHTML

Discovery Timeline

2025-07-07 - CVE-2025-4779 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4779

Vulnerability Analysis

The flaw is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation. Lunary's v1/runs/ingest API endpoint accepts run telemetry without authentication. When the request body includes an empty citations field, the server-side logic branches into a rendering path that later passes attacker-controlled content to React's dangerouslySetInnerHTML. React does not sanitize content passed through this property. The stored payload persists in the backend and executes whenever a dashboard user opens the affected run. Attack complexity is low and no privileges are required, though user interaction is needed for the payload to fire.

Root Cause

The root cause is the combination of unauthenticated write access to the v1/runs/ingest endpoint and unsafe rendering of stored content. The application trusts ingested strings and passes them into dangerouslySetInnerHTML without HTML entity encoding or a sanitizer such as DOMPurify. The empty citations field acts as a branching condition that reaches the vulnerable render path.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP POST request to v1/runs/ingest containing a JavaScript payload and an empty citations array. The malicious record is persisted to the Lunary datastore. When an authenticated operator later views the run in the Lunary UI, the browser executes the payload with the operator's session context. See the Huntr Bounty Report for the disclosure details and the GitHub Commit Update for the fix.

Detection Methods for CVE-2025-4779

Indicators of Compromise

POST requests to /v1/runs/ingest containing citations: [] or citations: "" combined with <script>, onerror=, or javascript: tokens.
Stored run records containing HTML tags, event handlers, or encoded script payloads.
Outbound requests from operator browsers to attacker-controlled domains shortly after loading a Lunary run view.

Detection Strategies

Inspect web application firewall logs for anomalous payloads targeting the v1/runs/ingest endpoint, particularly requests with empty citations fields.
Query stored run data for HTML or JavaScript syntax in fields expected to contain plain text.
Correlate ingest events with dashboard access events to identify potential victim sessions.

Monitoring Recommendations

Enable verbose request logging on the Lunary API layer and forward logs to a centralized analytics platform.
Alert on unauthenticated POST volume spikes to /v1/runs/ingest from unfamiliar source addresses.
Monitor browser console errors and Content Security Policy (CSP) violation reports from users of the Lunary dashboard.

How to Mitigate CVE-2025-4779

Immediate Actions Required

Upgrade lunary-ai/lunary to version 1.9.24 or later without delay.
Restrict network access to the v1/runs/ingest endpoint using authentication or IP allowlists until the patch is applied.
Review stored run records for injected HTML or JavaScript and purge malicious entries.
Rotate session tokens and API keys for any users who accessed dashboards during the exposure window.

Patch Information

The maintainers addressed the issue in commit 18750294a76ff6c0f3f1b6af4ac1a23399836b16, released in Lunary 1.9.24. Review the fix in the GitHub Commit Update and the coordinated disclosure in the Huntr Bounty Report.

Workarounds

Deploy a reverse proxy rule that rejects requests to /v1/runs/ingest containing HTML tags or script tokens.
Enforce a strict Content Security Policy on the Lunary dashboard to block inline script execution.
Require authentication in front of Lunary's ingest API using an API gateway or service mesh policy.

bash

# Upgrade Lunary to the patched release
npm install lunary@1.9.24
# or, for containerized deployments
docker pull lunary/lunary:1.9.24
docker compose up -d