TI-2025-33088 Aliases CVE-2025-53095

Sunshine application-wide CSRF in the UI leads to command injection as Administrator

MEDIUM 42CWE-352Published 2025-07-01 · Updated 2025-07-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Cross-Site Request Forgery (CSRF) attacks. This vulnerability allows an attacker to craft a malicious web page that, when visited by an authenticated user, can trigger unintended actions within the Sunshine application on behalf of that user. Specifically, since the application does OS command execution by design, this issue can be exploited to abuse the "Command Preparations" feature, enabling an attacker to inject arbitrary commands that will be executed with Administrator privileges when an application is launched. This issue has been patched in version 2025.628.4510.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00239 15th percentileScored 2026-11-07

Fix Fixed Sunshine (LizardByte): 2025.628.4510

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
LizardByte	Sunshine	before 2025.628.4510	2025.628.4510	Patch available	CNA

Sunshine VendorLizardByte Affected before 2025.628.4510 Fixed in 2025.628.4510 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:lizardbyte:sunshine::::::::	before 2025.628.4510	Vulnerable	LizardByte

cpe:2.3:a:lizardbyte:sunshine:*:*:*:*:*:*:*:* Versions before 2025.628.4510 Vulnerable ·LizardByte

Remediation

Fix · CNA Sunshine (LizardByte) Fixed in 2025.628.4510

Timeline

2026-10-02 Threatist record created from CVE-2025-53095

References

Patch 1

https://github.com/LizardByte/Sunshine/commit/738ac93a0ec1cd10412d1f339968775f53bfefe0

Advisory 1

https://github.com/LizardByte/Sunshine/security/advisories/GHSA-39hj-fxvw-758m

TI-2026-24782 Sunshine: Authentication bypass via improper client certificate validation CVSS 3.1CRITICAL 9.8
TI-2025-33924 SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution CVSS 3.1HIGH 7.0
TI-2024-34644 Sunshine improperly enforces pairing protocol request order CVSS 4.0HIGH 7.7
TI-2025-09364 A local privilege escalation vulnerability exists in LizardBytes' Sunshine for Windows CVSS 3.1HIGH 7.8
TI-2025-09363 LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerability CVSS 3.1HIGH 7.8
TI-2024-20597 Sunshine vulnerable to remote unauthenticated arbitrary file read CVSS 3.1HIGH 7.3

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences