lunary vulnerabilities and fixes

Q: How do I fix lunary vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Q: Is lunary being exploited right now?

None of the tracked lunary CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Q: Which lunary CVE should I patch first?

CVE-2024-7456 currently ranks highest (62/100): A SQL injection vulnerability exists in the `/api/v1/external-users` route of lunary-ai/lunary version v1.4.2.

Recent CVEs affecting lunary, with upgrade or downgrade steps. 57 tracked.

lunary has 57 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 41. Most recent: 2026-02-02. Highest priority: CVE-2024-7456 (score 62/100).

CVE-2025-9803 HIGH 8.8 DOWNGRADE lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Goo
CVE-2025-5352 CRITICAL 9.6 UPGRADE A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/luna
CVE-2025-4779 MEDIUM 6.1 UPGRADE lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS)
CVE-2025-0281 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability exists in lunary-ai/lunary versions 1.6.7 and earlier
CVE-2024-9099 HIGH 8.1 DOWNGRADE In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys f
CVE-2024-9098 MEDIUM 6.1 UPGRADE In lunary-ai/lunary before version 1.4.30, a privilege escalation vulnerability exists where admins can invite
CVE-2024-9096 HIGH 7.1 DOWNGRADE In lunary-ai/lunary version 1.4.28, the /checklists/:id route allows low-privilege users to modify checklists
CVE-2024-9095 CRITICAL 9.8 DOWNGRADE In lunary-ai/lunary version v1.4.28, the /bigquery API route lacks proper access control, allowing any logged-
CVE-2024-9000 MEDIUM 6.5 DOWNGRADE In lunary-ai/lunary before version 1.4.26, the checklists.post() endpoint allows users to create or modify che
CVE-2024-8999 HIGH 7.5 UPGRADE lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-wa
CVE-2024-8998 HIGH 7.5 UPGRADE A Regular Expression Denial of Service (ReDoS) vulnerability exists in lunary-ai/lunary version git f07a845
CVE-2024-8789 HIGH 7.5 UPGRADE Lunary-ai/lunary version git 105a3f6 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack
CVE-2024-8765 HIGH 7.3 UPGRADE In lunary-ai/lunary, the privilege check mechanism is flawed in version git afc5df4
CVE-2024-8764 HIGH 7.5 UPGRADE A vulnerability in lunary-ai/lunary, as of commit be54057, allows users to upload and execute arbitrary regula
CVE-2024-8763 HIGH 7.5 UPGRADE A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary repository, specif
CVE-2024-7476 MEDIUM 4.3 UPGRADE A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2
CVE-2024-7475 CRITICAL 9.1 UPGRADE An improper access control vulnerability in lunary-ai/lunary version 1.3.2 allows an attacker to update the SA
CVE-2024-7474 HIGH 8.1 UPGRADE In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference (IDOR) vulnerability exists
CVE-2024-7473 MEDIUM 6.5 DOWNGRADE An IDOR vulnerability exists in the 'Evaluations' function of the 'umgws datasets' section in lunary-ai/lunary
CVE-2024-7472 MEDIUM 6.5 DOWNGRADE lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/use
CVE-2024-7456 CRITICAL 9.8 DOWNGRADE A SQL injection vulnerability exists in the `/api/v1/external-users` route of lunary-ai/lunary version v1.4.2
CVE-2024-6867 MEDIUM 6.5 DOWNGRADE An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/rel
CVE-2024-6862 HIGH 8.1 DOWNGRADE A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly perm
CVE-2024-6582 MEDIUM 4.3 UPGRADE A broken access control vulnerability exists in the latest version of lunary-ai/lunary
CVE-2024-6087 MEDIUM 6.5 UPGRADE An improper access control vulnerability exists in lunary-ai/lunary at the latest commit (a761d83) on the main
CVE-2024-6086 MEDIUM 4.3 DOWNGRADE In version 1.2.7 of lunary-ai/lunary, any authenticated user, regardless of their role, can change the name of
CVE-2024-5755 MEDIUM 5.3 UPGRADE In lunary-ai/lunary versions <=v1.2.11, an attacker can bypass email validation by using a dot character ('.')
CVE-2024-5714 MEDIUM 6.8 DOWNGRADE In lunary-ai/lunary version 1.2.4, an improper access control vulnerability allows members with team managemen
CVE-2024-5478 MEDIUM 6.1 DOWNGRADE A Cross-site Scripting (XSS) vulnerability exists in the SAML metadata endpoint `/auth/saml/${org?.id}/metadat
CVE-2024-5389 HIGH 8.1 DOWNGRADE In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users t
CVE-2024-5386 HIGH 8.8 UPGRADE In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token lea
CVE-2024-5328 CRITICAL 9.3 MITIGATE A Server-Side Request Forgery (SSRF) vulnerability exists in the lunary-ai/lunary application, specifically wi
CVE-2024-5277 HIGH 7.5 UPGRADE In lunary-ai/lunary version 1.2.4, a vulnerability exists in the password recovery mechanism where the reset p
CVE-2024-5248 MEDIUM 6.5 UPGRADE In lunary-ai/lunary version 1.2.5, an improper access control vulnerability exists due to a missing permission
CVE-2024-5133 HIGH 8.1 UPGRADE In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password re
CVE-2024-5131 MEDIUM 6.5 UPGRADE An Improper Access Control vulnerability exists in the lunary-ai/lunary repository, affecting versions up to a
CVE-2024-5130 HIGH 7.5 UPGRADE An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which
CVE-2024-5129 HIGH 8.2 UPGRADE A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any d
CVE-2024-5128 HIGH 8.8 UPGRADE An Insecure Direct Object Reference (IDOR) vulnerability was identified in lunary-ai/lunary, affecting version
CVE-2024-5127 MEDIUM 5.4 UPGRADE In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper access control vulnerability allows users on th
CVE-2024-5126 MEDIUM 6.5 UPGRADE An improper access control vulnerability exists in the lunary-ai/lunary repository, specifically within the ve
CVE-2024-4147 MEDIUM 6.5 UPGRADE In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users t
CVE-2024-4146 CRITICAL 9.8 DOWNGRADE In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized
CVE-2024-3760 HIGH 7.5 UPGRADE In lunary-ai/lunary version 1.2.7, there is a lack of rate limiting on the forgot password page, leading to an
CVE-2024-3504 MEDIUM 6.5 UPGRADE An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where
CVE-2024-3502 HIGH 8.1 UPGRADE In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists where a
CVE-2024-3501 HIGH 8.1 UPGRADE In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists due to
CVE-2024-3379 HIGH 8.1 UPGRADE In lunary-ai/lunary versions 1.2.2 through 1.2.6, an incorrect authorization vulnerability allows unprivileged
CVE-2024-11301 MEDIUM 6.5 UPGRADE In lunary-ai/lunary before version 1.6.3, the application allows the creation of evaluators without enforcing
CVE-2024-11300 MEDIUM 6.5 UPGRADE In lunary-ai/lunary before version 1.6.3, an improper access control vulnerability exists where a user can acc
CVE-2024-11137 HIGH 7.5 UPGRADE An Insecure Direct Object Reference (IDOR) vulnerability exists in the `PATCH /v1/runs/:id/score` endpoint of
CVE-2024-10762 HIGH 8.1 UPGRADE In lunary-ai/lunary before version 1.5.9, the /v1/evaluators/ endpoint allows users to delete evaluators of a
CVE-2024-10330 MEDIUM 6.5 UPGRADE In lunary-ai/lunary version 1.5.6, the `/v1/evaluators/` endpoint lacks proper access control, allowing any us
CVE-2024-10275 HIGH 7.3 UPGRADE In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions
CVE-2024-10274 MEDIUM 6.5 UPGRADE An improper authorization vulnerability exists in lunary-ai/lunary version 1.5.5
CVE-2024-10273 MEDIUM 6.5 UPGRADE In lunary-ai/lunary v1.5.0, improper privilege management in the models.ts file allows users with viewer roles
CVE-2024-10272 HIGH 7.5 UPGRADE lunary-ai/lunary is vulnerable to broken access control in the latest version

FAQ

How do I fix lunary vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is lunary being exploited right now?

None of the tracked lunary CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which lunary CVE should I patch first?

CVE-2024-7456 currently ranks highest (62/100): A SQL injection vulnerability exists in the `/api/v1/external-users` route of lunary-ai/lunary version v1.4.2.

RSS feed for lunary · ← Back to latest CVEs