CVE-2024-7472
mediumpriority · track · 26EPSS 0.005 · 39 %ileEUUSEPSS · scored 2026-10-27
lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/users/send-verification) and Sign up API (/auth/signup). An unauthenticated attacker can inject data into outgoing emails by bypassing the extractFirstName function using a different whitespace character (e.g., \xa0). This vulnerability can be exploited to conduct phishing attacks, damage the application's brand, cause legal and compliance issues, and result in financial impact due to unauthorized email usage.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://github.com/lunary-ai/lunary/commit/a39837d7c49936a0c435d241f37ca2ea7904d2cdcnnvd
- https://github.com/lunary-ai/lunary/releases/tag/v1.5.8Patchcnnvd
- https://huntr.com/bounties/dc1feec6-1efb-4538-9b56-ab25deb80948cnnvd
- https://github.com/lunary-ai/lunary/commit/a39837d7c49936a0c435d241f37ca2ea7904d2cdenisa_euvd
- https://huntr.com/bounties/dc1feec6-1efb-4538-9b56-ab25deb80948enisa_euvd
- https://github.com/lunary-ai/lunary/commit/a39837d7c49936a0c435d241f37ca2ea7904d2cdPatchnvd
- https://huntr.com/bounties/dc1feec6-1efb-4538-9b56-ab25deb80948ExploitThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan