Lookyloo
Monthly
Stored cross-site scripting in Lookyloo (versions up to and including 1.40.0) lets an attacker inject arbitrary HTML/JavaScript into the capture tree visualization page. Because the serialized capture tree was rendered directly into an inline <script> block via the Jinja `safe` filter, attacker-controlled content captured from a target website can break out of the script element and execute in the browser of any analyst who later views that capture tree. No public exploit identified at time of analysis; EPSS is low (0.28%, 20th percentile), consistent with the SSVC assessment of no observed exploitation, but the impact rating is total.
Cross-user state leakage in Lookyloo's PlaywrightCapture Python library allows one capture operation to inherit sensitive data from another when multiple Capture objects run within the same Python process. Because capture-specific settings (HTTP headers, cookies, browser storage, HTTP credentials, proxy, user-agent, geolocation) were stored as mutable class-level rather than instance-level variables, a concurrent or subsequent capture in a multi-user deployment can disclose or reuse another user's authentication cookies, credentials, and captured request data. Exploitation requires low privileges (PR:L, a legitimate user of a shared deployment); a vendor patch exists (commit 1e354b9) and no public exploit identified at time of analysis.
Server-side request forgery in PlaywrightCapture's favicon retrieval function allows a remote attacker to cause the PlaywrightCapture host to issue HTTP requests to internal or loopback-addressed services by exploiting a redirect-bypass in the aiohttp HTTP client. When the `only_global_lookup` configuration is active, the library validates the user-supplied favicon URL before the first request but does not re-validate URLs generated by automatic HTTP redirects, allowing a publicly reachable attacker-controlled URL to redirect to restricted destinations such as 127.0.0.1 or internal network services. Depending on what internal HTTP services are reachable from the PlaywrightCapture host and how favicon response content is surfaced, this enables internal network probing and potential information disclosure. A patch is available via the upstream Lookyloo repository; no active exploitation has been identified.
PlaywrightCapture's only_global_lookup SSRF protection is bypassed during favicon retrieval, allowing an attacker who can supply a web page for processing to direct the capture host's aiohttp HTTP client against loopback addresses, private IP ranges, or internal DNS names. The bypass arises because favicon URLs parsed from rendered HTML were fetched via a separate aiohttp.ClientSession that did not consult the same IP and hostname validation logic applied to browser-routed Playwright requests. No public exploit identified at time of analysis; a patch is available via upstream commit.
Memory exhaustion in Lookyloo 1.40.0 and earlier allows attackers to crash web or worker processes by submitting a crafted ZIP capture archive or gzip-compressed HAR payload that expands to an enormous size when decompressed in memory, degrading or taking the instance offline until processes are restarted. Both the full capture-archive import path and the API submission path that accepts gzip-compressed HAR data are affected, and although authentication requirements are not confirmed for every entry point, the published CVSS:4.0 vector records PR:N for the API path. The vulnerability is vendor-patched via upstream commit 96589da (a 1 GB uncompressed ceiling plus size-bounded zlib/gzip decompression), there is no CISA KEV listing, no public exploit code identified at time of analysis, and the EPSS score is a low 0.25% (17th percentile); this is a genuine but modest-priority denial-of-service issue rather than a high-urgency threat.
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo passed improperly escaped values to cells rendered in datatables using the orthogonal-data feature. It is definitely exploitable from the popup view, but it is most probably also exploitable in many other places. This vulnerability is fixed in 1.35.3.
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnerability can be triggered when a user submits a list of URLs to capture, one of them contains a HTML element, and the capture fails. Then, the error field is populated with an error message that contains the bad URL they tried to capture, triggering the XSS. This vulnerability is fixed in 1.35.3.
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, there are multiple XSS due to unsafe use of f-strings in Markup. The issue requires a malicious 3rd party server responding with a JSON document containing JS code in a script element. This vulnerability is fixed in 1.35.3.
Stored cross-site scripting in Lookyloo (versions up to and including 1.40.0) lets an attacker inject arbitrary HTML/JavaScript into the capture tree visualization page. Because the serialized capture tree was rendered directly into an inline <script> block via the Jinja `safe` filter, attacker-controlled content captured from a target website can break out of the script element and execute in the browser of any analyst who later views that capture tree. No public exploit identified at time of analysis; EPSS is low (0.28%, 20th percentile), consistent with the SSVC assessment of no observed exploitation, but the impact rating is total.
Cross-user state leakage in Lookyloo's PlaywrightCapture Python library allows one capture operation to inherit sensitive data from another when multiple Capture objects run within the same Python process. Because capture-specific settings (HTTP headers, cookies, browser storage, HTTP credentials, proxy, user-agent, geolocation) were stored as mutable class-level rather than instance-level variables, a concurrent or subsequent capture in a multi-user deployment can disclose or reuse another user's authentication cookies, credentials, and captured request data. Exploitation requires low privileges (PR:L, a legitimate user of a shared deployment); a vendor patch exists (commit 1e354b9) and no public exploit identified at time of analysis.
Server-side request forgery in PlaywrightCapture's favicon retrieval function allows a remote attacker to cause the PlaywrightCapture host to issue HTTP requests to internal or loopback-addressed services by exploiting a redirect-bypass in the aiohttp HTTP client. When the `only_global_lookup` configuration is active, the library validates the user-supplied favicon URL before the first request but does not re-validate URLs generated by automatic HTTP redirects, allowing a publicly reachable attacker-controlled URL to redirect to restricted destinations such as 127.0.0.1 or internal network services. Depending on what internal HTTP services are reachable from the PlaywrightCapture host and how favicon response content is surfaced, this enables internal network probing and potential information disclosure. A patch is available via the upstream Lookyloo repository; no active exploitation has been identified.
PlaywrightCapture's only_global_lookup SSRF protection is bypassed during favicon retrieval, allowing an attacker who can supply a web page for processing to direct the capture host's aiohttp HTTP client against loopback addresses, private IP ranges, or internal DNS names. The bypass arises because favicon URLs parsed from rendered HTML were fetched via a separate aiohttp.ClientSession that did not consult the same IP and hostname validation logic applied to browser-routed Playwright requests. No public exploit identified at time of analysis; a patch is available via upstream commit.
Memory exhaustion in Lookyloo 1.40.0 and earlier allows attackers to crash web or worker processes by submitting a crafted ZIP capture archive or gzip-compressed HAR payload that expands to an enormous size when decompressed in memory, degrading or taking the instance offline until processes are restarted. Both the full capture-archive import path and the API submission path that accepts gzip-compressed HAR data are affected, and although authentication requirements are not confirmed for every entry point, the published CVSS:4.0 vector records PR:N for the API path. The vulnerability is vendor-patched via upstream commit 96589da (a 1 GB uncompressed ceiling plus size-bounded zlib/gzip decompression), there is no CISA KEV listing, no public exploit code identified at time of analysis, and the EPSS score is a low 0.25% (17th percentile); this is a genuine but modest-priority denial-of-service issue rather than a high-urgency threat.
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo passed improperly escaped values to cells rendered in datatables using the orthogonal-data feature. It is definitely exploitable from the popup view, but it is most probably also exploitable in many other places. This vulnerability is fixed in 1.35.3.
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnerability can be triggered when a user submits a list of URLs to capture, one of them contains a HTML element, and the capture fails. Then, the error field is populated with an error message that contains the bad URL they tried to capture, triggering the XSS. This vulnerability is fixed in 1.35.3.
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, there are multiple XSS due to unsafe use of f-strings in Markup. The issue requires a malicious 3rd party server responding with a JSON document containing JS code in a script element. This vulnerability is fixed in 1.35.3.