CVE-2024-7472

lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/users/send-verification) and Sign up API (/auth/signup). An unauthenticated attacker can inject data into outgoing emails by bypassing the extractFirstName function using a different whitespace character (e.g., \xa0). This vulnerability can be exploited to conduct phishing attacks, damage the application's brand, cause legal and compliance issues, and result in financial impact due to unauthorized email usage.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/lunary-ai/lunary/commit/a39837d7c49936a0c435d241f37ca2ea7904d2cd	Patch
https://huntr.com/bounties/dc1feec6-1efb-4538-9b56-ab25deb80948	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lunary:lunary:1.2.26:*:*:*:*:*:*:*

History

15 Oct 2025, 13:15

Type	Values Removed	Values Added
CWE	~~CWE-75~~	CWE-93

Information

Published : 2024-10-29 13:15

Updated : 2025-10-15 13:15

NVD link : CVE-2024-7472

Mitre link : CVE-2024-7472

CVE.ORG link : CVE-2024-7472

JSON object : View

Products Affected

lunary

lunary

CWE

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

{"id": "CVE-2024-7472", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-10-29T13:15:09.093", "references": [{"url": "https://github.com/lunary-ai/lunary/commit/a39837d7c49936a0c435d241f37ca2ea7904d2cd", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/dc1feec6-1efb-4538-9b56-ab25deb80948", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-93"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": "lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/users/send-verification) and Sign up API (/auth/signup). An unauthenticated attacker can inject data into outgoing emails by bypassing the extractFirstName function using a different whitespace character (e.g., \\xa0). This vulnerability can be exploited to conduct phishing attacks, damage the application's brand, cause legal and compliance issues, and result in financial impact due to unauthorized email usage."}, {"lang": "es", "value": "lunary-ai/lunary v1.2.26 contiene una vulnerabilidad de inyecci\u00f3n de correo electr\u00f3nico en la API de verificaci\u00f3n de env\u00edo de correo electr\u00f3nico (/v1/users/send-verification) y la API de registro (/auth/signup). Un atacante no autenticado puede inyectar datos en los correos electr\u00f3nicos salientes al omitir la funci\u00f3n extractFirstName utilizando un car\u00e1cter de espacio en blanco diferente (por ejemplo, \\xa0). Esta vulnerabilidad se puede explotar para realizar ataques de phishing, da\u00f1ar la marca de la aplicaci\u00f3n, causar problemas legales y de cumplimiento y generar un impacto financiero debido al uso no autorizado del correo electr\u00f3nico."}], "lastModified": "2025-10-15T13:15:52.097", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lunary:lunary:1.2.26:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85C53140-9D39-4835-A1FA-24F98F18FD27"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}