CVE-2025-65095
CriticalSummary
Lookyloo prior to version 1.35.1 has potential cross-site scripting on index and tree pages. This issue has been patched in version 1.35.1.
Risk Assessment
An attacker can inject malicious scripts, potentially leading to session theft or account takeover.
Recommendation
Upgrade Lookyloo to version 1.35.1 or later.
Other vulnerabilities in Lookyloo
See all- CVE-2026-73210Medium
A Server-Side Request Forgery (SSRF) vulnerability was found in Lookyloo's PlaywrightCapture when the only_global_lookup option is enabled. Favicon retrieval was performed outside the browser request-routing protections, allowing an attacker to send HTTP requests to internal resources (e.g., loopback, private IPs) via a crafted web page. The patch introduces a common URL validation routine for favicon retrieval, rejecting non-public destinations.
- CVE-2026-66913Medium
Lookyloo does not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker can submit a crafted archive that expands to a very large size, exhausting memory and causing denial of service.
Original NVD description (English source)
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.35.1, there is potential cross-site scripting on index and tree page. This issue has been patched in version 1.35.1.