Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Loading CVE intelligence

Loading vulnerability catalog

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

CVE-2025-5352

CriticalPublished

Environment Variable XSS in Analytics Component in lunary-ai/lunary

Published: Aug 23, 2025
Updated: Aug 25, 2025
Assigning CNA: @huntr_ai
Evidence observed: Aug 28, 2026

Primary CVSS

9.6/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS probability estimate

0.5%

Low · next 30 days

Percentile: 41.5%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXT_PUBLIC_CUSTOM_SCRIPT environment variable is directly injected into the DOM using dangerouslySetInnerHTML without any sanitization or validation. This allows arbitrary JavaScript execution in all users' browsers if an attacker can control the environment variable during deployment or through server compromise. The vulnerability can lead to complete account takeover, data exfiltration, malware distribution, and persistent attacks affecting all users until the environment variable is cleaned. The issue is fixed in version 1.9.25.

Sources

CVE-2025-5352PoC
Demonstrates a stored XSS vulnerability in lunary-ai/lunary's Analytics component, where unsanitized NEXT_PUBLIC_CUSTOM_SCRIPT injection leads to arbitrary JavaScript execution in users' browsers.

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.