sahiloj/CVE-2025-5352

PoC

A stored XSS vulnerability exists in the Analytics component of lunary-ai/lunary where NEXT_PUBLIC_CUSTOM_SCRIPT is injected into the DOM using dangerouslySetInnerHTML without sanitization. An attacker controlling this variable during deployment or via server compromise can run arbitrary JavaScript in all users’ browsers.

view exploit source poc_in_githubauthor sahilojpublished 2025-12-05catalog poc_in_github
01

exploited CVEs (1)

Known CVEs related to this entry.

IDseverity exploitable
CVE-2025-5352UScritical9.6Exploit
A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXT_PUBLIC_CUSTOM_SCRIPT environm…
scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan