CVE-2026-12811 describes a cross-site scripting vulnerability in the kortix-ai suna product affecting versions up to 0.8.38. The vulnerability arises from improper handling of the returnURL argument in the router.replace/router.push functions of the Auth Endpoint component (apps/frontend/src/app/auth/page.tsx). An attacker can manipulate this argument to execute arbitrary scripts in the context of the victim's browser. The vulnerability is remotely exploitable and has a CVSS 4.0 base score of 5.3 (medium severity). The issue was resolved in version 0.8.39 by a patch identified as f5dec7aa0c1b8fa0125938f292c0f2430ca75f6c. No official vendor advisory or remediation level is provided, but upgrading to 0.8.39 is advised.

Successful exploitation allows an attacker to perform cross-site scripting attacks, potentially leading to execution of malicious scripts in users' browsers. This can result in session hijacking, defacement, or other client-side attacks. The vulnerability is remotely exploitable without privileges or user interaction other than visiting a crafted URL. The CVSS score of 5.3 indicates a medium impact level.

Upgrade kortix-ai suna to version 0.8.39 or later, which contains the fix for this vulnerability. The patch is identified by commit f5dec7aa0c1b8fa0125938f292c0f2430ca75f6c. No other official mitigations or temporary fixes are documented. Since the vendor did not widely disclose the fix, users should proactively update to the fixed version to mitigate risk.