EUVD-2025-200310Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo passed improperly escaped values to cells rendered in datatables using the orthogonal-data feature. It is definitely exploitable from the popup view, but it is most probably also exploitable in many other places. This vulnerability is fixed in 1.35.3.
Analysis
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo passed improperly escaped values to cells rendered in datatables using the orthogonal-data feature. It is definitely exploitable from the popup view, but it is most probably also exploitable in many other places. This vulnerability is fixed in 1.35.3.
Technical ContextAI
Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.
RemediationAI
A vendor patch is available — apply it immediately. Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.
Stored cross-site scripting in Lookyloo (versions up to and including 1.40.0) lets an attacker inject arbitrary HTML/Jav
Cross-user state leakage in Lookyloo's PlaywrightCapture Python library allows one capture operation to inherit sensitiv
Server-side request forgery in PlaywrightCapture's favicon retrieval function allows a remote attacker to cause the Play
We need to produce a JSON object with the specified fields. The input provides CVE-2026-66913 details, multi-source inte
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call eac
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call eac
PlaywrightCapture's only_global_lookup SSRF protection is bypassed during favicon retrieval, allowing an attacker who ca
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today