CVE-2026-12811

A weakness has been identified in kortix-ai suna up to 0.8.38. Affected by this issue is the function router.replace/router.push of the file apps/frontend/src/app/auth/page.tsx of the component Auth Endpoint. Executing a manipulation of the argument returnURL can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.8.39 can resolve this issue. This patch is called f5dec7aa0c1b8fa0125938f292c0f2430ca75f6c. It is advisable to upgrade the affected component. The researcher explains: "The issue was fixed in v0.8.39 without notifying the wider user base via a security disclosure."

CVSS v3 4.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://gist.github.com/TrebledJ/fe7241910ac0aaeff86243fc88e9ffed
https://github.com/kortix-ai/suna/
https://github.com/kortix-ai/suna/commit/f5dec7aa0c1b8fa0125938f292c0f2430ca75f6c
https://github.com/kortix-ai/suna/releases/tag/v0.8.39
https://vuldb.com/cve/CVE-2026-12811
https://vuldb.com/submit/837175
https://vuldb.com/vuln/372605
https://vuldb.com/vuln/372605/cti

Configurations

No configuration.

History

21 Jun 2026, 23:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-21 23:16

Updated : 2026-06-23 14:17

NVD link : CVE-2026-12811

Mitre link : CVE-2026-12811

CVE.ORG link : CVE-2026-12811

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-12811", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12811", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T13:37:34.514663Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:kortix-ai:suna:*:*:*:*:*:*:*:*"], "vendor": "kortix-ai", "modules": ["Auth Endpoint"], "product": "suna", "versions": [{"status": "affected", "version": "0.8.0"}, {"status": "affected", "version": "0.8.1"}, {"status": "affected", "version": "0.8.2"}, {"status": "affected", "version": "0.8.3"}, {"status": "affected", "version": "0.8.4"}, {"status": "affected", "version": "0.8.5"}, {"status": "affected", "version": "0.8.6"}, {"status": "affected", "version": "0.8.7"}, {"status": "affected", "version": "0.8.8"}, {"status": "affected", "version": "0.8.9"}, {"status": "affected", "version": "0.8.10"}, {"status": "affected", "version": "0.8.11"}, {"status": "affected", "version": "0.8.12"}, {"status": "affected", "version": "0.8.13"}, {"status": "affected", "version": "0.8.14"}, {"status": "affected", "version": "0.8.15"}, {"status": "affected", "version": "0.8.16"}, {"status": "affected", "version": "0.8.17"}, {"status": "affected", "version": "0.8.18"}, {"status": "affected", "version": "0.8.19"}, {"status": "affected", "version": "0.8.20"}, {"status": "affected", "version": "0.8.21"}, {"status": "affected", "version": "0.8.22"}, {"status": "affected", "version": "0.8.23"}, {"status": "affected", "version": "0.8.24"}, {"status": "affected", "version": "0.8.25"}, {"status": "affected", "version": "0.8.26"}, {"status": "affected", "version": "0.8.27"}, {"status": "affected", "version": "0.8.28"}, {"status": "affected", "version": "0.8.29"}, {"status": "affected", "version": "0.8.30"}, {"status": "affected", "version": "0.8.31"}, {"status": "affected", "version": "0.8.32"}, {"status": "affected", "version": "0.8.33"}, {"status": "affected", "version": "0.8.34"}, {"status": "affected", "version": "0.8.35"}, {"status": "affected", "version": "0.8.36"}, {"status": "affected", "version": "0.8.37"}, {"status": "affected", "version": "0.8.38"}, {"status": "unaffected", "version": "0.8.39"}]}]}], "published": "2026-06-21T23:16:42.693", "references": [{"url": "https://gist.github.com/TrebledJ/fe7241910ac0aaeff86243fc88e9ffed", "source": "cna@vuldb.com"}, {"url": "https://github.com/kortix-ai/suna/", "source": "cna@vuldb.com"}, {"url": "https://github.com/kortix-ai/suna/commit/f5dec7aa0c1b8fa0125938f292c0f2430ca75f6c", "source": "cna@vuldb.com"}, {"url": "https://github.com/kortix-ai/suna/releases/tag/v0.8.39", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-12811", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/837175", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/372605", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/372605/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in kortix-ai suna up to 0.8.38. Affected by this issue is the function router.replace/router.push of the file apps/frontend/src/app/auth/page.tsx of the component Auth Endpoint. Executing a manipulation of the argument returnURL can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.8.39 can resolve this issue. This patch is called f5dec7aa0c1b8fa0125938f292c0f2430ca75f6c. It is advisable to upgrade the affected component. The researcher explains: \"The issue was fixed in v0.8.39 without notifying the wider user base via a security disclosure.\""}], "lastModified": "2026-06-23T14:17:22.467", "sourceIdentifier": "cna@vuldb.com"}