CVE Feed

    Dashboard / CVE / CVE-2024-8998

    CVE-2024-8998

    A Regular Expression Denial of Service (ReDoS) vulnerability exists in lunary-ai/lunary version git f07a845. The server uses the regex /{.*?}/ to match user-controlled strings. In the default JavaScript regex engine, this regex can take polynomial time to match certain crafted user inputs. As a result, an attacker can cause the server to hang for an arbitrary amount of time by submitting a specially crafted payload. This issue is fixed in version 1.4.26.

    Published:Mar 20, 2025
    Last Modified:Apr 4, 2025
    EPS:Mar 20, 2025
    EPSS Score:0.0011
    CVSS Score:7.5

    Affected Products

    Vendor
    Lunary
    Product
    Lunary

    Exploits

    https://huntr.com/bounties/4dbd8648-1dca-4f95-b74f-978ef030e97ehttps://huntr.com/bounties/4dbd8648-1dca-4f95-b74f-978ef030e97e

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-492 Regular Expression Exponential Blowup

    Related CVEs

    CVE-2024-5386 (CVSS 8.8) — In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token lea…
    CVE-2024-4147 (CVSS 6.5) — In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users t…
    CVE-2025-9803 (CVSS 8.8) — lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Goo…
    CVE-2025-5352 (CVSS 9.6) — A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/luna…
    CVE-2025-4779 (CVSS 6.1) — lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthentica…
    CVE-2024-11300 (CVSS 6.5) — In lunary-ai/lunary before version 1.6.3, an improper access control vulnerability exists where a user can acc…
    CVE-2024-10272 (CVSS 7.5) — lunary-ai/lunary is vulnerable to broken access control in the latest version. An attacker can view the conten…
    CVE-2025-0281 (CVSS 5.4) — A stored cross-site scripting (XSS) vulnerability exists in lunary-ai/lunary versions 1.6.7 and earlier. An at…
    CVE-2024-9099 (CVSS 8.1) — In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys f…
    CVE-2024-8765 (CVSS 7.3) — In lunary-ai/lunary, the privilege check mechanism is flawed in version git afc5df4. The system incorrectly id…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High