RansomLook EUVD-2026-64891

Exploitation requires two sequential conditions: first, a malicious wallet address or blockchain name must be present in the RansomLook datastore, reachable either by submitting a crafted record to the public ransomwhe.re crowd-sourced feed (no RansomLook account required) or by an authenticated administrator adding a wallet record via the admin interface (PR:L or PR:H for that path). Second, an authenticated or unauthenticated RansomLook user (depending on the instance's access controls) must navigate to the affected wallet's detail page and click the CSV export button - active user interaction is required. Exploitation is limited to: deployments consuming the ransomwhe.re feed or exposing the admin wallet-creation endpoint, users who visit and interact with the specific wallet detail page, and browser contexts where the victim has an active RansomLook session with privileges the attacker wishes to abuse. Non-default restriction of wallet detail pages to authenticated users raises the bar for impact but does not prevent the injection-via-feed step.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.8, but the UI:N metric appears inconsistent with the description: successful exploitation requires a victim user to click the CSV export button, which constitutes active user interaction. The VA:H (high availability impact on the vulnerable system) also appears overstated for a stored XSS that primarily affects confidentiality and integrity via session hijacking or credential theft. Independent reassessment places this closer to a CVSS 3.1 medium (approximately 6.1) with UI:R and S:C. EPSS data was not provided. There is no CISA KEV listing and no known public exploit, so real-world exploitation risk is currently low-to-moderate. The most significant risk amplifier is the indirect injection path: because the ransomwhe.re feed is a public crowd-sourced resource, the barrier to injecting a malicious wallet record may be considerably lower than compromising RansomLook itself. Defenders should weight this supply-chain-style injection path heavily when assessing priority, despite the absence of KEV or POC. The patch is confirmed available.

An attacker submits a crafted cryptocurrency address such as x';alert(document.cookie)// to the public ransomwhe.re crowd-sourced feed. When RansomLook's importer next syncs the feed, the address is stored in Redis without validation. A RansomLook user browsing the affected ransomware group's wallet detail page and clicking the CSV export button triggers the inline onclick handler, which decodes Jinja2's HTML entity escaping and executes the injected JavaScript in the victim's browser session. No public exploit code is known at time of analysis, but the attack is straightforward given knowledge of the template rendering behavior documented in the patch diff.