CVE-2024-6862: Withdrawn Advisory: Lunary Cross-Site Request Forgery (CSRF) vulnerability

September 13, 2024 (updated June 20, 2025)

Withdrawn Advisory

This advisory has been withdrawn because the lunary npm package is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory.

References

github.com/advisories/GHSA-v6x6-4v4x-2fx9
github.com/lunary-ai/lunary
github.com/lunary-ai/lunary/commit/3451fcd7b9d95e9091d62c515752f39f2faa6e54
huntr.com/bounties/0b1d851e-3455-480c-ad5a-23565894976f
nvd.nist.gov/vuln/detail/CVE-2024-6862

Code Behaviors & Features

Detect and mitigate CVE-2024-6862 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →