Read the docs
TI-2026-10949 Aliases CVE-2026-12811GHSA-fpgm-v536-ccc8

kortix-ai suna Auth Endpoint page.tsx router.push cross site scripting

Priority MEDIUM 57CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting, Code execution
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.

Summary

A weakness has been identified in kortix-ai suna up to 0.8.38. Affected by this issue is the function router.replace/router.push of the file apps/frontend/src/app/auth/page.tsx of the component Auth Endpoint. Executing a manipulation of the argument returnURL can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.8.39 can resolve this issue. This patch is called f5dec7aa0c1b8fa0125938f292c0f2430ca75f6c. It is advisable to upgrade the affected component. The researcher explains: "The issue was fixed in v0.8.39 without notifying the wider user base via a security disclosure."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00497 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed suna (kortix-ai): 0.8.39

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kortix-aisuna0.8.0; 0.8.1; 0.8.2; 0.8.3; 0.8.4; 0.8.5; 0.8.6; 0.8.7; 0.8.8; 0.8.9; 0.8.10; 0.8.11; 0.8.12; 0.8.13; 0.8.14; 0.8.15; 0.8.16; 0.8.17; 0.8.18; 0.8.19; 0.8.20; 0.8.21; 0.8.22; 0.8.23; 0.8.24; 0.8.25; 0.8.26; 0.8.27; 0.8.28; 0.8.29; 0.8.30; 0.8.31; 0.8.32; 0.8.33; 0.8.34; 0.8.35; 0.8.36; 0.8.37; 0.8.380.8.39Patch availableCNA
  • suna Vendorkortix-ai Affected 0.8.0; 0.8.1; 0.8.2; 0.8.3; 0.8.4; 0.8.5; 0.8.6; 0.8.7; 0.8.8; 0.8.9; 0.8.10; 0.8.11; 0.8.12; 0.8.13; 0.8.14; 0.8.15; 0.8.16; 0.8.17; 0.8.18; 0.8.19; 0.8.20; 0.8.21; 0.8.22; 0.8.23; 0.8.24; 0.8.25; 0.8.26; 0.8.27; 0.8.28; 0.8.29; 0.8.30; 0.8.31; 0.8.32; 0.8.33; 0.8.34; 0.8.35; 0.8.36; 0.8.37; 0.8.38 Fixed in 0.8.39 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:kortix-ai:suna:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:kortix-ai:suna:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA suna (kortix-ai) Fixed in 0.8.39

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12811
  2. 2026-10-03 Alias added: GHSA-fpgm-v536-ccc8

References

Exploit 1

Patch 2

Other 1

  • TI-2026-47016 Suna < 0.9.102 Broken Access Control via Message Queue API CVSS 4.0HIGH 8.7
  • TI-2026-70528 Server-side request forgery in Kortix Suna bypasses IP guard CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences