CVE-2026-73210
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A Server-Side Request Forgery (SSRF) vulnerability was found in Lookyloo's PlaywrightCapture when the only_global_lookup option is enabled. Favicon retrieval was performed outside the browser request-routing protections, allowing an attacker to send HTTP requests to internal resources (e.g., loopback, private IPs) via a crafted web page. The patch introduces a common URL validation routine for favicon retrieval, rejecting non-public destinations.
Risk Assessment
The risk is the potential interaction with internal network services that should not be reachable through a capture. This could enable internal service discovery, access to internal resources, or manipulation of HTTP endpoints in the infrastructure, posing a threat to confidentiality and integrity.
Recommendation
It is recommended to update Lookyloo to a version containing the fix (CVE-2026-73210) immediately. If updating is not possible, consider disabling the only_global_lookup option or restricting access to internal services via firewall.
Other vulnerabilities in Lookyloo
See all- CVE-2025-65095Critical
Lookyloo prior to version 1.35.1 has potential cross-site scripting on index and tree pages. This issue has been patched in version 1.35.1.
- CVE-2026-66913Medium
Lookyloo does not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker can submit a crafted archive that expands to a very large size, exhausting memory and causing denial of service.
- CVE-2025-66460Medium
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo passed improperly escaped values to cells rendered in datatables using the orthogonal-data feature. It is definitely exploitable from the popup view, but it is most probably also exploitable in many other places. This vulnerability is fixed in 1.35.3.
- CVE-2025-66459Medium
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnerability can be triggered when a user submits a list of URLs to capture, one of them contains a HTML element, and the capture fails. Then, the error field is populated with an error message that contains the bad URL they tried to capture, triggering the XSS. This vulnerability is fixed in 1.35.3.
- CVE-2025-66458Medium
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, there are multiple XSS due to unsafe use of f-strings in Markup. The issue requires a malicious 3rd party server responding with a JSON document containing JS code in a script element. This vulnerability is fixed in 1.35.3.
Original NVD description (English source)
A Server-Side Request Forgery (SSRF) vulnerability existed in Lookyloo's PlaywrightCapture when the only_global_lookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval was performed separately from the browser request-routing protections. Favicon URLs extracted from rendered HTML were resolved and subsequently fetched directly using an aiohttp.ClientSession. An attacker able to supply or control a web page processed by PlaywrightCapture could include a crafted favicon reference, for example pointing to a loopback address, private IP address, or another resource reachable only from the PlaywrightCapture host. When the page was processed, the favicon retrieval routine could issue an HTTP request to this destination despite only_global_lookup being enabled. This bypass could therefore be used to make the PlaywrightCapture host interact with internal network services that should not be reachable through a capture. Depending on the targeted service and its response, this could enable internal service discovery, access to internal resources, or interaction with HTTP endpoints available only from the capture infrastructure. The patch introduces a common URL validation routine and applies it to favicon retrieval. Direct non-global IP addresses, localhost, .local domains, malformed URLs, and other explicitly non-public destinations are rejected before the favicon request is performed. This fix is a complementary fix to CVE-2026-44439 - GCVE-0-2026-44439 - GHSA-687H-XW6F-Q2QW
Vulnerability data from NVD (NIST) · CISA KEV · EPSS