CVE-2025-5352

A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXT_PUBLIC_CUSTOM_SCRIPT environment variable is directly injected into the DOM using dangerouslySetInnerHTML without any sanitization or validation. This allows arbitrary JavaScript execution in all users' browsers if an attacker can control the environment variable during deployment or through server compromise. The vulnerability can lead to complete account takeover, data exfiltration, malware distribution, and persistent attacks affecting all users until the environment variable is cleaned. The issue is fixed in version 1.9.25.

• CWE-79

• https://github.com/lunary-ai/lunary/commit/e2e43e88cecf742bacb639ab880507bbfdfd065cPatch
• https://huntr.com/bounties/f1d3dbce-3c3e-480e-b81e-0e8afa05c491Exploit, Patch, Third Party Advisory

Published

Aug 23, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-53514Mattermost Confluence Plugin version <1.5.0 fails to handle …5.9
• CVE-2025-53515A vulnerability exists in Advantech iView that allows for SQ…8.8
• CVE-2025-53516A reflected cross-site scripting (xss) vulnerability exists …6.1
• CVE-2025-53517Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-53518An integer overflow vulnerability exists in the ABF parsing …9.8
• CVE-2025-53519A vulnerability exists in Advantech iView versions prior to …5.4
• CVE-2025-53520The affected product allows firmware updates to be downloade…8.8
• CVE-2025-53521When a BIG-IP APM access policy is configured on a virtual s…9.8
• CVE-2025-53522Movable Type contains an issue with use of less trusted sour…6.9
• CVE-2025-53523Stored cross-site scripting vulnerabilities exist in GroupSe…5.4
• CVE-2025-53524Fuji Electric Monitouch V-SFT-6 is vulnerable to an out-of-b…8.4
• CVE-2025-53525WeGIA is a web manager for charitable institutions. A Reflec…6.1