Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2025-5352 PoC — Lunary 跨站脚本漏洞

Source
https://github.com/sahiloj/CVE-2025-5352
Associated Vulnerability
Title:Lunary 跨站脚本漏洞 (CVE-2025-5352)
Description:Lunary是Lunary开源的一个 LLM 的生产工具包。 Lunary 1.9.23及之前版本存在跨站脚本漏洞，该漏洞源于Analytics组件存在存储型跨站脚本，可能导致任意JavaScript执行。
Description
A stored XSS vulnerability exists in the Analytics component of lunary-ai/lunary where NEXT_PUBLIC_CUSTOM_SCRIPT is injected into the DOM using dangerouslySetInnerHTML without sanitization. An attacker controlling this variable during deployment or via server compromise can run arbitrary JavaScript in all users’ browsers.
File Snapshot

 None
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.