Is CVE-2024-6862 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-6862 being exploited in the wild.

How severe is CVE-2024-6862?

Low severity, with a CVSS score of 3, published 13 September 2024.

Which products and versions are affected?

@lunary/backend (npm) SEMVER:introduced=0,fixed=1.4.10; lunary (npm) SEMVER:introduced=0,fixed=1.4.10.

Is there a fix for CVE-2024-6862?

Yes. @lunary/backend (npm): upgrade to 1.4.10 or later; lunary (npm): upgrade to 1.4.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-6862 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-6862?

Check whether you run @lunary/backend (npm) or lunary (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-6862: Lunary Cross-Site Request Forgery in CORS

CVE-2024-6862 · Severity: low · CVSS 3 · Published 2024-09-13

Lunary is an open-source AI platform with backend and frontend components. A CSRF vulnerability in overly permissive CORS settings could allow attackers to hijack locally-hosted instances and sign up for projects or access the system as an authorized user. This primarily affects instances running on personal machines without internet exposure, but compromises local security and user intent.

Technologies: lunary (npm). Vendors: npm.

Quick answers

Is CVE-2024-6862 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-6862 being exploited in the wild.
How severe is CVE-2024-6862?: Low severity, with a CVSS score of 3, published 13 September 2024.
Which products and versions are affected?: @lunary/backend (npm) SEMVER:introduced=0,fixed=1.4.10; lunary (npm) SEMVER:introduced=0,fixed=1.4.10.
Is there a fix for CVE-2024-6862?: Yes. @lunary/backend (npm): upgrade to 1.4.10 or later; lunary (npm): upgrade to 1.4.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-6862 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-6862?: Check whether you run @lunary/backend (npm) or lunary (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@lunary/backend (npm): upgrade to 1.4.10 or later
```
npm install @lunary/backend@1.4.10
```
lunary (npm): upgrade to 1.4.10 or later
```
npm install lunary@1.4.10
```

Technical details

A Cross-Site Request Forgery (CWE-352) vulnerability exists in Lunary versions prior to 1.4.10 due to overly permissive CORS settings that allow all origins. Unauthenticated endpoints are exposed to CSRF attacks, allowing an attacker to perform state-changing actions (account signup, project creation) without user consent. The attack requires user interaction (the user must visit an attacker-controlled page while logged into Lunary) and is particularly effective against locally-hosted instances. The vulnerability has been fixed in version 1.4.10 by restricting CORS policies. The advisory was withdrawn because it targeted the wrong repository, though the underlying vulnerability in the npm packages remains valid.

Affected products

Lunary lunary before 1.4.10
Lunary @lunary/backend before 1.4.10

Identifiers

CVE-2024-6862
GHSA-v6x6-4v4x-2fx9

Timeline

2024-09-13: disclosed
2025-06-20: other: Advisory withdrawn

References

https://github.com/lunary-ai/lunary/commit/3451fcd7b9d95e9091d62c515752f39f2faa6e54

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.