Executive brief
Lunary, a backend service platform, contained a cross-site scripting (XSS) vulnerability in its SAML authentication metadata endpoint. An attacker could inject malicious JavaScript code through an unsanitized organization ID parameter, potentially allowing theft of user cookies or authentication tokens. This advisory has been withdrawn because the affected component does not correspond to a supported package ecosystem product.
Technical details
A reflected XSS vulnerability (CWE-79) exists in the SAML metadata endpoint /auth/saml/${org?.id}/metadata due to improper input validation on the orgId parameter. The application directly embeds the orgId into generated XML SAML metadata responses without sanitization, allowing arbitrary JavaScript injection. The vulnerability requires user interaction (clicking a malicious link) and is network-accessible without authentication. An attacker can craft a URL with a malicious orgId to execute arbitrary JavaScript in a victim's browser context, compromising session cookies and authentication tokens. The advisory was withdrawn in June 2025 as the npm package "lunary" references a different repository than the vulnerable lunary-ai/lunary backend; however, the underlying vulnerability remains valid for the backend codebase.
Affected products
- lunary-ai lunary 1.2.7 and earlier
Timeline
- 2024-06-06: disclosed
- 2025-06-20: withdrawn