# CVE-2024-6862: Lunary Cross-Site Request Forgery in CORS

Source: https://junglewise.ai/threats/cve-2024-6862-lunary-cross-site-request-forgery-in-cors  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-09-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-6862 · Severity: low · CVSS 3 · Published 2024-09-13

Lunary is an open-source AI platform with backend and frontend components. A CSRF vulnerability in overly permissive CORS settings could allow attackers to hijack locally-hosted instances and sign up for projects or access the system as an authorized user. This primarily affects instances running on personal machines without internet exposure, but compromises local security and user intent.

Technologies: [lunary (npm)](https://junglewise.ai/threats/technologies/lunary). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-6862 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-6862 being exploited in the wild.

**How severe is CVE-2024-6862?** Low severity, with a CVSS score of 3, published 13 September 2024.

**Which products and versions are affected?** @lunary/backend (npm) SEMVER:introduced=0,fixed=1.4.10; lunary (npm) SEMVER:introduced=0,fixed=1.4.10.

**Is there a fix for CVE-2024-6862?** Yes. @lunary/backend (npm): upgrade to 1.4.10 or later; lunary (npm): upgrade to 1.4.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-6862 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-6862?** Check whether you run @lunary/backend (npm) or lunary (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @lunary/backend (npm): upgrade to 1.4.10 or later

  ```sh
  npm install @lunary/backend@1.4.10
  ```

- lunary (npm): upgrade to 1.4.10 or later

  ```sh
  npm install lunary@1.4.10
  ```


## Technical details

A Cross-Site Request Forgery (CWE-352) vulnerability exists in Lunary versions prior to 1.4.10 due to overly permissive CORS settings that allow all origins. Unauthenticated endpoints are exposed to CSRF attacks, allowing an attacker to perform state-changing actions (account signup, project creation) without user consent. The attack requires user interaction (the user must visit an attacker-controlled page while logged into Lunary) and is particularly effective against locally-hosted instances. The vulnerability has been fixed in version 1.4.10 by restricting CORS policies. The advisory was withdrawn because it targeted the wrong repository, though the underlying vulnerability in the npm packages remains valid.

## Affected products

- Lunary lunary before 1.4.10
- Lunary @lunary/backend before 1.4.10

## Identifiers

- CVE-2024-6862
- GHSA-v6x6-4v4x-2fx9

## Timeline

- 2024-09-13: disclosed
- 2025-06-20: other: Advisory withdrawn

## References

- [https://github.com/lunary-ai/lunary/commit/3451fcd7b9d95e9091d62c515752f39f2faa6e54](https://github.com/lunary-ai/lunary/commit/3451fcd7b9d95e9091d62c515752f39f2faa6e54)

## Related threats

- [Lunary improper access control in invite user functionality](https://junglewise.ai/threats/cve-2024-6087-lunary-improper-access-control-in-invite-user-functionality)
- [Lunary information disclosure in runs endpoint](https://junglewise.ai/threats/cve-2024-6867-lunary-information-disclosure-in-runs-endpoint)
- [Lunary improper authentication in SAML configuration](https://junglewise.ai/threats/cve-2024-6582-lunary-improper-authentication-in-saml-configuration)
- [Lunary-ai Lunary access control bypass in prompt variation management](https://junglewise.ai/threats/lunary-ai-lunary-access-control-bypass-in-prompt-variation-management-cd347a2d)
- [lunary-ai lunary authorization bypass in project access](https://junglewise.ai/threats/cve-2024-4146-lunary-ai-lunary-authorization-bypass-in-project-access)