CVE-2026-12811

kortix-ai suna Auth Endpoint page.tsx router.push cross site scripting

State: Published
Severity: 5.3 Medium
Published: Jun 21, 2026
Updated: Jun 23, 2026
Reserved: Jun 21, 2026

Description

A weakness has been identified in kortix-ai suna up to 0.8.38. Affected by this issue is the function router.replace/router.push of the file apps/frontend/src/app/auth/page.tsx of the component Auth Endpoint. Executing a manipulation of the argument returnURL can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.8.39 can resolve this issue. This patch is called f5dec7aa0c1b8fa0125938f292c0f2430ca75f6c. It is advisable to upgrade the affected component. The researcher explains: "The issue was fixed in v0.8.39 without notifying the wider user base via a security disclosure."

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-79 Cross Site Scripting
CWE-94 Code Injection

Affected Products

Product	Versions
sunakortix-ai	0.8.0Affected 0.8.1Affected 0.8.2Affected 0.8.3Affected 0.8.4Affected 0.8.5Affected 0.8.6Affected 0.8.7Affected 0.8.8Affected 0.8.9Affected 0.8.10Affected 0.8.11Affected 0.8.12Affected 0.8.13Affected 0.8.14Affected 0.8.15Affected 0.8.16Affected 0.8.17Affected 0.8.18Affected 0.8.19Affected 0.8.20Affected 0.8.21Affected 0.8.22Affected 0.8.23Affected 0.8.24Affected and 15 more versions

References

VDB-372605 | kortix-ai suna Auth Endpoint page.tsx router.push cross site scriptingvdb-entrytechnical-description
VDB-372605 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-12811 | CVE Analysis and Reportthird-party-advisory
Submit #837175 | Kortix AI Suna < 0.8.39 DOM-XSS, Open Redirectthird-party-advisory
https://gist.github.com/TrebledJ/fe7241910ac0aaeff86243fc88e9ffedexploit
https://github.com/kortix-ai/suna/commit/f5dec7aa0c1b8fa0125938f292c0f2430ca75f6cpatch
https://github.com/kortix-ai/suna/releases/tag/v0.8.39patch
https://github.com/kortix-ai/suna/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.