sahiloj/cve-2025-5352Demonstrates a stored XSS vulnerability in lunary-ai/lunary's Analytics component, where unsanitized NEXT_PUBLIC_CUSTOM_SCRIPT injection leads to arbitrary JavaScript execution in users' browsers.
CVE-2025-5352
A stored Cross-Site Scripting (XSS) vulnerability has been identified in the Analytics component of lunary-ai/lunary. The issue arises because the NEXT_PUBLIC_CUSTOM_SCRIPT variable is injected directly into the DOM using dangerouslySetInnerHTML without proper sanitization or validation.
If an attacker is able to control this variable then either during the deployment process or through a server compromise, they can inject arbitrary JavaScript code. This malicious script would execute in the browsers of all users accessing the affected application, potentially leading to session hijacking, credential theft, or other client-side attacks.
