[GHSA-v6x6-4v4x-2fx9] Lunary Cross-Site Request Forgery (CSRF) vulnerability

[hughcrt]

Updates

• Affected products
• CVSS v3

Comments
The NPM package is not tied to this repo. This vulnerability concerns the main repo, not the NPM compagnon package.

[Copilot]

Pull Request Overview

This PR updates the vulnerability advisory for the Lunary CSRF issue by adjusting metadata fields to reflect current information and clarifying the affected components.

• Updated the modified timestamp to a more recent version.
• Removed the CVSS_V3 severity block in favor of the CVSS_V4 specification.
• Cleared the npm package name to indicate that the vulnerability is not tied to the NPM package.

[Copilot]

The npm package name has been set to an empty string. If this is intentional to denote that the NPM package is unrelated, consider either removing the entire package block or adding an inline comment to clarify the rationale.

Suggested change

	"name": ""
	"name": "lunary"

[advisory-database]

Hi @hughcrt! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!