CVE-2026-12811 describes a cross-site scripting vulnerability in the kortix-ai suna product affecting versions up to 0.8.38. The vulnerability resides in the router.replace/router.push functions of the apps/frontend/src/app/auth/page.tsx file, specifically in the Auth Endpoint component. Manipulating the returnURL parameter can trigger XSS, allowing an attacker to execute arbitrary scripts in the context of the affected application. The vulnerability can be exploited remotely without privileges or user interaction beyond UI involvement. The issue was patched in version 0.8.39 by commit f5dec7aa0c1b8fa0125938f292c0f2430ca75f6c. The fix was applied without a formal security disclosure from the vendor.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the vulnerable application, potentially leading to session hijacking, credential theft, or other malicious actions performed on behalf of the victim user. The vulnerability requires user interaction but no privileges or authentication. The CVSS 4.0 base score is 5.3, indicating a medium severity impact.

Upgrade kortix-ai suna to version 0.8.39 or later, which contains the fix for this vulnerability. Since the vendor has released a patch, applying this official update is the recommended remediation. There is no indication that the vendor has provided alternative mitigations or that the issue is already mitigated without patching.