CVE-2025-53095

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Cross-Site Request Forgery (CSRF) attacks. This vulnerability allows an attacker to craft a malicious web page that, when visited by an authenticated user, can trigger unintended actions within the Sunshine application on behalf of that user. Specifically, since the application does OS command execution by design, this issue can be exploited to abuse the "Command Preparations" feature, enabling an attacker to inject arbitrary commands that will be executed with Administrator privileges when an application is launched. This issue has been patched in version 2025.628.4510.

• CWE-352

• https://github.com/LizardByte/Sunshine/commit/738ac93a0ec1cd10412d1f339968775f53bfefe0Patch
• https://github.com/LizardByte/Sunshine/security/advisories/GHSA-39hj-fxvw-758mVendor Advisory

Published

Jul 1, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-53085A memory corruption vulnerability exists in the PSD RLE Deco…8.8
• CVE-2025-5309The chat feature within Remote Support (RS) and Privileged R…9.8
• CVE-2025-53091WeGIA is an open source web manager with a focus on the Port…9.8
• CVE-2025-53092Strapi is an open source headless content management system.…6.5
• CVE-2025-53093TabberNeue is a MediaWiki extension that allows the wiki to …8.6
• CVE-2025-53094ESPAsyncWebServer is an asynchronous HTTP and WebSocket serv…8.7
• CVE-2025-53096Sunshine is a self-hosted game stream host for Moonlight. Pr…6.1
• CVE-2025-53097Roo Code is an AI-powered autonomous coding agent. Prior to …7.5
• CVE-2025-53098Roo Code is an AI-powered autonomous coding agent. The proje…8.1
• CVE-2025-53099Sentry is a developer-first error tracking and performance m…7.5
• CVE-2025-5310Dover Fueling Solutions ProGauge MagLink LX Consoles expose …9.8
• CVE-2025-53100RestDB's Codehooks.io MCP Server is an MCP server on the Cod…8.6