High · published August 23, 2025
⚡ A sneaky stored XSS vulnerability lurks in lunary-ai/lunary versions up to 1.9.23, allowing attackers to inject malicious scripts into users' browsers with a mere environment variable! 🔥 Think of it like a restaurant that accepts orders without verifying what's in them — an unscrupulous chef could add anything to the menu, endangering every diner who places an order. In this case, the dangerouslySetInnerHTML is that unverified order, serving up a feast of malicious JavaScript! An attacker who gains control over the NEXT_PUBLIC_CUSTOM_SCRIPT variable can unleash devastating consequences — from hijacking user accounts to exfiltrating sensitive data and distributing malware that affects all users. Imagine a scenario where every user is served a dish laced with harmful ingredients, leaving them vulnerable until the menu is cleaned up!
Think of it like a restaurant that accepts orders without verifying what's in them — an unscrupulous chef could add anything to the menu, endangering every diner who places an order. In this case, the dangerouslySetInnerHTML is that unverified order, serving up a feast of malicious JavaScript! This stored XSS vulnerability allows arbitrary JavaScript to execute in all users' browsers due to the unvalidated injection of environment variables directly into the DOM using dangerouslySetInnerHTML. This means that if an attacker compromises the server or environment variable, they can run any script they desire.
An attacker who gains control over the NEXT_PUBLIC_CUSTOM_SCRIPT variable can unleash devastating consequences — from hijacking user accounts to exfiltrating sensitive data and distributing malware that affects all users. Imagine a scenario where every user is served a dish laced with harmful ingredients, leaving them vulnerable until the menu is cleaned up! To safeguard your applications, upgrade to lunary version 1.9.25 or later immediately. Additionally, review your deployment practices to ensure that environment variables are secured and validated before being used in the application. Implement input sanitization where necessary to prevent similar vulnerabilities from occurring. You've got this! With these steps, you'll not only protect your users but also boost your security hero status! 🛡️