EUVD-2026-64891
GHSA-mp5g-mcx2-r5xh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No RansomLook privileges needed via feed injection path; stored XSS requires victim to click, so UI:R; scope changes to victim browser; no availability impact.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
RansomLook contains a stored cross-site scripting (XSS) vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later embedded directly into an inline JavaScript onclick handler.
Although Jinja HTML autoescaping was applied, it does not provide adequate protection when untrusted data is inserted into a JavaScript string inside an HTML attribute. HTML entities such as ' are decoded by the browser's HTML parser before the resulting attribute is interpreted as JavaScript. Consequently, a specially crafted cryptocurrency address containing quote characters and JavaScript syntax could escape the intended string literal and execute arbitrary JavaScript when a user clicked the affected wallet's CSV export button.
Because cryptocurrency information imported from an untrusted upstream could reach the vulnerable rendering path, exploitation may not require an authenticated RansomLook account if an attacker can introduce a malicious wallet record into a consumed external data source. Successful exploitation could allow attacker-controlled JavaScript to execute in the security context of the RansomLook web application, potentially exposing information accessible to the victim or performing actions with the victim's privileges.
The patch mitigates the issue by validating cryptocurrency addresses and blockchain identifiers before storage, restricting them to a safe character set, and replacing the inline JavaScript handler with data-* attributes and an external event listener so wallet values are treated strictly as data rather than executable JavaScript.
AnalysisAI
Stored XSS in RansomLook's cryptocurrency wallet detail view allows attacker-controlled JavaScript to execute in the security context of any user who clicks the CSV export button on an affected wallet record. The root cause is insertion of externally-sourced wallet addresses and blockchain names directly into an inline JavaScript onclick handler, where Jinja2's HTML autoescaping is bypassed because the browser's HTML parser decodes entities such as ' back to quote characters before the JavaScript engine processes the attribute value. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two sequential conditions: first, a malicious wallet address or blockchain name must be present in the RansomLook datastore, reachable either by submitting a crafted record to the public ransomwhe.re crowd-sourced feed (no RansomLook account required) or by an authenticated administrator adding a wallet record via the admin interface (PR:L or PR:H for that path). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.8, but the UI:N metric appears inconsistent with the description: successful exploitation requires a victim user to click the CSV export button, which constitutes active user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted cryptocurrency address such as x';alert(document.cookie)// to the public ransomwhe.re crowd-sourced feed. When RansomLook's importer next syncs the feed, the address is stored in Redis without validation. … |
| Remediation | The primary fix is to update RansomLook to the patched version by applying or pulling commit 7efb59253f23552538f9a11c9bf21e7bcfcc1319 from https://github.com/RansomLook/RansomLook/commit/7efb59253f23552538f9a11c9bf21e7bcfcc1319. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all RansomLook instances deployed in your environment and obtain the vendor's security advisory and patch details. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ransomlook
View allSensitive credential disclosure in RansomLook (versions 0 through 2.0.0) exposes full API keys in the rendered HTML of t
Broken authorization in RansomLook's web-based configuration editor (the /admin/config endpoint) lets any authenticated
Unauthenticated private-data disclosure in RansomLook, an open-source ransomware-leak-site tracking platform, allows any
Missing authorization in RansomLook, an open-source ransomware-intelligence tracking platform, lets unauthenticated remo
Unauthenticated remote attackers can create crypto group entries in RansomLook by directly accessing the /admin/crypto/g
Three compounding authentication weaknesses in RansomLook's /login endpoint allow an unauthenticated remote attacker to
Sensitive scraping credentials and bypass logic were exposed to unauthenticated callers through multiple RansomLook API
RansomLook versions through 2.0.0 leaks victim posts belonging to privately configured ransomware groups and markets thr
Path traversal in RansomLook's GroupPost.get API handler allows an attacker controlling a malicious upstream instance to
PDF export in RansomLook allows authenticated analysts to read arbitrary server-side files and conduct server-side reque
Insecure file creation in RansomLook (≤ 2.0.0) exposes the Flask session-signing secret to any local OS user with read a
Redis glob pattern injection in Ransomlook versions up to and including 2.0.0 allows unauthenticated remote attackers to
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today