Stored Cross-site Scripting (XSS) in lunary-ai/lunary

lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthenticated attacker can inject malicious JavaScript into the `v1/runs/ingest` endpoint by adding an empty `citations` field, triggering a code path where `dangerouslySetInnerHTML` is used to render attacker-controlled text. This vulnerability allows the execution of arbitrary JavaScript in the context of the user's browser, potentially leading to session hijacking, data theft, or other malicious actions.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Lunary 跨站脚本漏洞

Lunary是Lunary开源的一个 LLM 的生产工具包。 Lunary 1.9.24之前版本存在跨站脚本漏洞，该漏洞源于v1/runs/ingest端点输入未清理，可能导致存储型跨站脚本攻击。

N/A

N/A