lunary-ai vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-5386 In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak.High 8.8 · Feb 2, 2026
• CVE-2025-9803 lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration.High 8.8 · Nov 24, 2025
• CVE-2025-5352 A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXT_PUBLIC_CUCritical 9.6 · Aug 23, 2025
• CVE-2025-4962 An Insecure Direct Object Reference (IDOR) vulnerability was identified in the `POST /v1/templates` endpoint of the Lunary API, affecting versions up to 0.8.8.High 7.7 · Aug 18, 2025
• CVE-2024-9099 In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions,High 8.1 · Mar 20, 2025
• CVE-2024-9096 In lunary-ai/lunary version 1.4.28, the /checklists/:id route allows low-privilege users to modify checklists by sending a PATCH request.High 7.1 · Mar 20, 2025
• CVE-2024-9095 In lunary-ai/lunary version v1.4.28, the /bigquery API route lacks proper access control, allowing any logged-in user to create a Datastream to Google BigQuery Critical 9.8 · Mar 20, 2025
• CVE-2024-8999 lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint.High 7.5 · Mar 20, 2025
• CVE-2024-8998 A Regular Expression Denial of Service (ReDoS) vulnerability exists in lunary-ai/lunary version git f07a845.High 7.5 · Mar 20, 2025
• CVE-2024-8789 Lunary-ai/lunary version git 105a3f6 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack.High 7.5 · Mar 20, 2025
• CVE-2024-8765 In lunary-ai/lunary, the privilege check mechanism is flawed in version git afc5df4.High 7.3 · Mar 20, 2025
• CVE-2024-8764 A vulnerability in lunary-ai/lunary, as of commit be54057, allows users to upload and execute arbitrary regular expressions on the server side.High 7.5 · Mar 20, 2025
• CVE-2024-8763 A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary repository, specifically in the compileTextTemplate function.High 7.5 · Mar 20, 2025
• CVE-2024-11137 An Insecure Direct Object Reference (IDOR) vulnerability exists in the `PATCH /v1/runs/:id/score` endpoint of lunary-ai/lunary version 1.6.0.High 7.5 · Mar 20, 2025
• CVE-2024-10762 In lunary-ai/lunary before version 1.5.9, the /v1/evaluators/ endpoint allows users to delete evaluators of a project by sending a DELETE request.High 8.1 · Mar 20, 2025
• CVE-2024-10275 In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions to access billing resources, can change the permisHigh 7.3 · Mar 20, 2025
• CVE-2024-10272 lunary-ai/lunary is vulnerable to broken access control in the latest version.High 7.5 · Mar 20, 2025
• CVE-2024-3760 In lunary-ai/lunary version 1.2.7, there is a lack of rate limiting on the forgot password page, leading to an email bombing vulnerability.High 7.5 · Nov 14, 2024
• CVE-2024-3502 In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists where account recovery hashes of users are inadvertently High 8.1 · Nov 14, 2024
• CVE-2024-3501 In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists due to the inclusion of single-use tokens in the responseHigh 8.1 · Nov 14, 2024
• CVE-2024-3379 In lunary-ai/lunary versions 1.2.2 through 1.2.6, an incorrect authorization vulnerability allows unprivileged users to re-generate the private key for projectsHigh 8.1 · Nov 14, 2024
• CVE-2024-7456 A SQL injection vulnerability exists in the `/api/v1/external-users` route of lunary-ai/lunary version v1.4.2.Critical 9.8 · Nov 1, 2024
• CVE-2024-7475 An improper access control vulnerability in lunary-ai/lunary version 1.3.2 allows an attacker to update the SAML configuration without authorization.Critical 9.1 · Oct 29, 2024
• CVE-2024-7474 In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference (IDOR) vulnerability exists.High 8.1 · Oct 29, 2024
• CVE-2024-6862 A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings.High 8.1 · Sep 13, 2024