Lookyloo
Monthly
Stored cross-site scripting in Lookyloo (versions up to and including 1.40.0) lets an attacker inject arbitrary HTML/JavaScript into the capture tree visualization page. Because the serialized capture tree was rendered directly into an inline <script> block via the Jinja `safe` filter, attacker-controlled content captured from a target website can break out of the script element and execute in the browser of any analyst who later views that capture tree. No public exploit identified at time of analysis; EPSS is low (0.28%, 20th percentile), consistent with the SSVC assessment of no observed exploitation, but the impact rating is total.
Cross-user state leakage in Lookyloo's PlaywrightCapture Python library allows one capture operation to inherit sensitive data from another when multiple Capture objects run within the same Python process. Because capture-specific settings (HTTP headers, cookies, browser storage, HTTP credentials, proxy, user-agent, geolocation) were stored as mutable class-level rather than instance-level variables, a concurrent or subsequent capture in a multi-user deployment can disclose or reuse another user's authentication cookies, credentials, and captured request data. Exploitation requires low privileges (PR:L, a legitimate user of a shared deployment); a vendor patch exists (commit 1e354b9) and no public exploit identified at time of analysis.
Server-side request forgery in PlaywrightCapture's favicon retrieval function allows a remote attacker to cause the PlaywrightCapture host to issue HTTP requests to internal or loopback-addressed services by exploiting a redirect-bypass in the aiohttp HTTP client. When the `only_global_lookup` configuration is active, the library validates the user-supplied favicon URL before the first request but does not re-validate URLs generated by automatic HTTP redirects, allowing a publicly reachable attacker-controlled URL to redirect to restricted destinations such as 127.0.0.1 or internal network services. Depending on what internal HTTP services are reachable from the PlaywrightCapture host and how favicon response content is surfaced, this enables internal network probing and potential information disclosure. A patch is available via the upstream Lookyloo repository; no active exploitation has been identified.
PlaywrightCapture's only_global_lookup SSRF protection is bypassed during favicon retrieval, allowing an attacker who can supply a web page for processing to direct the capture host's aiohttp HTTP client against loopback addresses, private IP ranges, or internal DNS names. The bypass arises because favicon URLs parsed from rendered HTML were fetched via a separate aiohttp.ClientSession that did not consult the same IP and hostname validation logic applied to browser-routed Playwright requests. No public exploit identified at time of analysis; a patch is available via upstream commit.
We need to produce a JSON object with the specified fields. The input provides CVE-2026-66913 details, multi-source intelligence including patch availability, CPE, SSVC, EPSS not explicitly given (but EPSS is mentioned in the prompt; we don't have an EPSS score in the data). The prompt says "Use ALL the data provided — including references, EPSS, KEV status, patch availability, CPE strings, and tags". There's no EPSS score in the provided data. No KEV status. The SSVC data: Exploitation: none, Automatable: no, Technical Impact: partial. We have a patch available, commit link, the CWE-400 (Uncontrolled Resource Consumption). CVSS 4.0 vector provided. Key fields: - product_name: "Lookyloo" (2 words? "Lookyloo" is 1 word but I'll just say "Lookyloo"). It's an open source web-based tool for HTTP traffic analysis. So "Lookyloo". - summary: Must be original synthesis. Not copy description. The vulnerability is a denial-of-service via unbounded decompression of uploaded capture archives and compressed HAR files in Lookyloo. Affects versions up to 1.40.0. Attackers can submit a specially crafted ZIP, gzip, or zlib-compressed capture data that expands to a very large size in memory, causing memory exhaustion, process termination, and potential instance unavailability. Patch introduced 1 GB cumulative size limit and safe decompression. No active exploitation, no POC mentioned. EPSS not provided. So summary: "Memory exhaustion denial of service in Lookyloo versions ≤1.40.0 via crafted compressed uploads allows unauthenticated attackers to exhaust memory and crash the service." Check CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A... UI:A means user interaction required? Actually UI:A means Active? CVSS 4.0: UI (User Interaction) can be None (N), Required (R), or Active (A). UI:A means "Active interaction with the vulnerable component is required to exploit the vulnerability." That's unusual for a server-side attack. Typically for DoS, if an attacker can just send a compressed file,
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo passed improperly escaped values to cells rendered in datatables using the orthogonal-data feature. It is definitely exploitable from the popup view, but it is most probably also exploitable in many other places. This vulnerability is fixed in 1.35.3.
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnerability can be triggered when a user submits a list of URLs to capture, one of them contains a HTML element, and the capture fails. Then, the error field is populated with an error message that contains the bad URL they tried to capture, triggering the XSS. This vulnerability is fixed in 1.35.3.
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, there are multiple XSS due to unsafe use of f-strings in Markup. The issue requires a malicious 3rd party server responding with a JSON document containing JS code in a script element. This vulnerability is fixed in 1.35.3.
Stored cross-site scripting in Lookyloo (versions up to and including 1.40.0) lets an attacker inject arbitrary HTML/JavaScript into the capture tree visualization page. Because the serialized capture tree was rendered directly into an inline <script> block via the Jinja `safe` filter, attacker-controlled content captured from a target website can break out of the script element and execute in the browser of any analyst who later views that capture tree. No public exploit identified at time of analysis; EPSS is low (0.28%, 20th percentile), consistent with the SSVC assessment of no observed exploitation, but the impact rating is total.
Cross-user state leakage in Lookyloo's PlaywrightCapture Python library allows one capture operation to inherit sensitive data from another when multiple Capture objects run within the same Python process. Because capture-specific settings (HTTP headers, cookies, browser storage, HTTP credentials, proxy, user-agent, geolocation) were stored as mutable class-level rather than instance-level variables, a concurrent or subsequent capture in a multi-user deployment can disclose or reuse another user's authentication cookies, credentials, and captured request data. Exploitation requires low privileges (PR:L, a legitimate user of a shared deployment); a vendor patch exists (commit 1e354b9) and no public exploit identified at time of analysis.
Server-side request forgery in PlaywrightCapture's favicon retrieval function allows a remote attacker to cause the PlaywrightCapture host to issue HTTP requests to internal or loopback-addressed services by exploiting a redirect-bypass in the aiohttp HTTP client. When the `only_global_lookup` configuration is active, the library validates the user-supplied favicon URL before the first request but does not re-validate URLs generated by automatic HTTP redirects, allowing a publicly reachable attacker-controlled URL to redirect to restricted destinations such as 127.0.0.1 or internal network services. Depending on what internal HTTP services are reachable from the PlaywrightCapture host and how favicon response content is surfaced, this enables internal network probing and potential information disclosure. A patch is available via the upstream Lookyloo repository; no active exploitation has been identified.
PlaywrightCapture's only_global_lookup SSRF protection is bypassed during favicon retrieval, allowing an attacker who can supply a web page for processing to direct the capture host's aiohttp HTTP client against loopback addresses, private IP ranges, or internal DNS names. The bypass arises because favicon URLs parsed from rendered HTML were fetched via a separate aiohttp.ClientSession that did not consult the same IP and hostname validation logic applied to browser-routed Playwright requests. No public exploit identified at time of analysis; a patch is available via upstream commit.
We need to produce a JSON object with the specified fields. The input provides CVE-2026-66913 details, multi-source intelligence including patch availability, CPE, SSVC, EPSS not explicitly given (but EPSS is mentioned in the prompt; we don't have an EPSS score in the data). The prompt says "Use ALL the data provided — including references, EPSS, KEV status, patch availability, CPE strings, and tags". There's no EPSS score in the provided data. No KEV status. The SSVC data: Exploitation: none, Automatable: no, Technical Impact: partial. We have a patch available, commit link, the CWE-400 (Uncontrolled Resource Consumption). CVSS 4.0 vector provided. Key fields: - product_name: "Lookyloo" (2 words? "Lookyloo" is 1 word but I'll just say "Lookyloo"). It's an open source web-based tool for HTTP traffic analysis. So "Lookyloo". - summary: Must be original synthesis. Not copy description. The vulnerability is a denial-of-service via unbounded decompression of uploaded capture archives and compressed HAR files in Lookyloo. Affects versions up to 1.40.0. Attackers can submit a specially crafted ZIP, gzip, or zlib-compressed capture data that expands to a very large size in memory, causing memory exhaustion, process termination, and potential instance unavailability. Patch introduced 1 GB cumulative size limit and safe decompression. No active exploitation, no POC mentioned. EPSS not provided. So summary: "Memory exhaustion denial of service in Lookyloo versions ≤1.40.0 via crafted compressed uploads allows unauthenticated attackers to exhaust memory and crash the service." Check CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A... UI:A means user interaction required? Actually UI:A means Active? CVSS 4.0: UI (User Interaction) can be None (N), Required (R), or Active (A). UI:A means "Active interaction with the vulnerable component is required to exploit the vulnerability." That's unusual for a server-side attack. Typically for DoS, if an attacker can just send a compressed file,
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo passed improperly escaped values to cells rendered in datatables using the orthogonal-data feature. It is definitely exploitable from the popup view, but it is most probably also exploitable in many other places. This vulnerability is fixed in 1.35.3.
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnerability can be triggered when a user submits a list of URLs to capture, one of them contains a HTML element, and the capture fails. Then, the error field is populated with an error message that contains the bad URL they tried to capture, triggering the XSS. This vulnerability is fixed in 1.35.3.
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, there are multiple XSS due to unsafe use of f-strings in Markup. The issue requires a malicious 3rd party server responding with a JSON document containing JS code in a script element. This vulnerability is fixed in 1.35.3.