CVE-2024-6867: Withdrawn Advisory: Lunary information disclosure vulnerability

September 13, 2024 (updated June 20, 2025)

Withdrawn Advisory

This advisory has been withdrawn because the lunary npm package is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory.

References

github.com/advisories/GHSA-9jmp-j63g-8x6m
github.com/lunary-ai/lunary/commit/35afd4439464571eb016318cd7b6f85a162225ca
huntr.com/bounties/460df515-164c-4435-954b-0233a181545f
nvd.nist.gov/vuln/detail/CVE-2024-6867

Code Behaviors & Features

Detect and mitigate CVE-2024-6867 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →