PatchSiren cyber security CVE debrief
CVE-2026-12811 kortix-ai CVE debrief
A weakness in kortix-ai suna up to 0.8.38 allows for cross-site scripting via the Auth Endpoint. The issue is caused by manipulation of the returnURL argument in the router.replace/router.push function. Upgrading to version 0.8.39 resolves this issue. This vulnerability has a low CVSS score of 2.1. Defenders should prioritize patching affected systems.
- Vendor
- kortix-ai
- Product
- suna
- CVSS
- LOW 2.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-21
- Original CVE updated
- 2026-06-23
- Advisory published
- 2026-06-21
- Advisory updated
- 2026-06-23
Who should care
Defenders responsible for kortix-ai suna deployments up to version 0.8.38 should prioritize patching. This vulnerability allows for remote cross-site scripting attacks, which could lead to unauthorized actions on the affected system. Although the CVSS score is low, defenders should still take action to limit exposure.
Technical summary
The vulnerability is located in the Auth Endpoint, specifically in the router.replace/router.push function of the file apps/frontend/src/app/auth/page.tsx. An attacker can manipulate the returnURL argument to inject malicious code, leading to cross-site scripting. The issue was fixed in version 0.8.39 with patch f5dec7aa0c1b8fa0125938f292c0f2430ca75f6c. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.
Defensive priority
Low-priority patching recommended due to low CVSS score, but defenders should still take action to limit exposure.
Recommended defensive actions
- Upgrade kortix-ai suna to version 0.8.39 or later
- Review and monitor affected systems for potential attacks
- Implement compensating controls to limit exposure
- Verify patch application and system configuration
- Track exceptions and anomalies in system logs
Evidence notes
The primary evidence for this vulnerability comes from the CVE record and the NVD detail page. The affected product is kortix-ai suna up to version 0.8.38. Defenders should verify the patch level and system configuration to ensure they are not vulnerable. The CVSS score and vector provide additional context for defenders to assess their exposure.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-12811 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-12811
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-12811 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-12811
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://gist.github.com/TrebledJ/fe7241910ac0aaeff86243fc88e9ffed
-
Source reference
Unverified legacy reference
URL: https://github.com/kortix-ai/suna/
-
Source reference
Unverified legacy reference
URL: https://github.com/kortix-ai/suna/commit/f5dec7aa0c1b8fa0125938f292c0f2430ca75f6c
-
Source reference
Unverified legacy reference
URL: https://github.com/kortix-ai/suna/releases/tag/v0.8.39
-
Source reference
Unverified legacy reference
URL: https://vuldb.com/cve/CVE-2026-12811
-
Source reference
Unverified legacy reference
URL: https://vuldb.com/submit/837175
-
Source reference
Unverified legacy reference
URL: https://vuldb.com/vuln/372605
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.