EUVD-2026-49585
GHSA-vjmw-phg6-9f2x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered stored XSS needing a victim to view the poisoned tree (UI:R); no attacker auth (PR:N); script executes in another security context (S:C) with high confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
Lifecycle Timeline
3DescriptionCVE.org
A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter.
Because the tree data can contain values derived from captured and potentially attacker-controlled web content, a specially crafted value could prematurely terminate the surrounding <script> element and inject arbitrary HTML or JavaScript. The malicious code would execute in the browser of a user viewing the affected capture tree.
Successful exploitation could allow an attacker to perform actions using the victim’s authenticated session, access information available to the victim, or modify application data within the permissions of the affected user.
The patch removes the JSON data from the HTML document and retrieves it through a dedicated API endpoint. The client then processes the response using response.json(), preventing capture data from being interpreted as executable content within the original page’s HTML or JavaScript context.
AnalysisAI
Stored cross-site scripting in Lookyloo (versions up to and including 1.40.0) lets an attacker inject arbitrary HTML/JavaScript into the capture tree visualization page. Because the serialized capture tree was rendered directly into an inline <script> block via the Jinja safe filter, attacker-controlled content captured from a target website can break out of the script element and execute in the browser of any analyst who later views that capture tree. No public exploit identified at time of analysis; EPSS is low (0.28%, 20th percentile), consistent with the SSVC assessment of no observed exploitation, but the impact rating is total.
Technical ContextAI
Lookyloo (cpe:2.3:a:lookyloo:lookyloo) is an open-source web-capture and investigation tool that records the resources, redirects, and content loaded by a URL and renders them as an interactive D3 tree. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The server-side Jinja template used the safe filter to embed the serialized tree JSON directly into an inline JavaScript variable, disabling output escaping. Since a captured page's own content (URLs, titles, response data) is folded into that tree, a crafted string such as a </script> sequence terminates the surrounding script element and injects new markup - the classic escaping-context failure when untrusted data is serialized into an HTML/JS context rather than fetched as pure data.
RemediationAI
Upgrade to a Lookyloo release that includes commit 395187b57322ab311363ccc290c010b180389009 (patch available per vendor; the fix landed above 1.40.0 - confirm the exact tagged release before deploying, as references point to a commit rather than a named version). The patch removes the tree JSON from the HTML document and serves it from a dedicated API endpoint (/json/<uuid>/tree_dump), with the client consuming it via response.json() so capture data is never interpreted as executable content. If you cannot update immediately, restrict access to the tree visualization page to trusted analysts, avoid opening capture trees from untrusted or externally submitted captures, and consider a Content-Security-Policy that forbids inline script execution on the Lookyloo web UI (trade-off: a strict CSP may break Lookyloo's own inline scripts and require testing). Advisory/patch: https://github.com/Lookyloo/lookyloo/commit/395187b57322ab311363ccc290c010b180389009.
Cross-user state leakage in Lookyloo's PlaywrightCapture Python library allows one capture operation to inherit sensitiv
Server-side request forgery in PlaywrightCapture's favicon retrieval function allows a remote attacker to cause the Play
We need to produce a JSON object with the specified fields. The input provides CVE-2026-66913 details, multi-source inte
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call eac
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call eac
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call eac
PlaywrightCapture's only_global_lookup SSRF protection is bypassed during favicon retrieval, allowing an attacker who ca
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today