CVE-2024-6087: Withdrawn Advisory: Lunary improper access control vulnerability

September 13, 2024 (updated June 20, 2025)

Withdrawn Advisory

This advisory has been withdrawn because the lunary npm package is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory.

References

github.com/advisories/GHSA-6p2q-8qfq-wq7x
github.com/lunary-ai/lunary
github.com/lunary-ai/lunary/commit/844e8855c7a713dc7371766dba4125de4007b1cf
huntr.com/bounties/bd9f2301-11c7-4cbd-8d77-3e9225bd67e8
nvd.nist.gov/vuln/detail/CVE-2024-6087

Code Behaviors & Features

Detect and mitigate CVE-2024-6087 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →