Security Research

Three npm Vulnerabilities in lunary-ai: SAML XSS, IDOR, and Privilege Escalation on the Same Trust Chain

Thinking 2024-12-19 8 min read Research Dossier
#Vulnerability Analysis#Code Audit#Web Security
Dark dossier of three overlapping CVE rings and a broken auth chain

The same npm package lunary-ai/lunary (before 1.6.7) exposed three CVEs at once — Stored XSS in SAML metadata, IDOR in the PATCH score endpoint, and Privilege Escalation in the PATCH model endpoint. All three trace to the same root: the boundary between authentication and authorization, the one that’s so easy to overlook.

Unlock to view this content.