Lookyloo vulnerabilities
3 known CVE vulnerabilities in Lookyloo, translated and rated.
- CVE-2025-65095Critical
Lookyloo prior to version 1.35.1 has potential cross-site scripting on index and tree pages. This issue has been patched in version 1.35.1.
- CVE-2026-73210Medium
A Server-Side Request Forgery (SSRF) vulnerability was found in Lookyloo's PlaywrightCapture when the only_global_lookup option is enabled. Favicon retrieval was performed outside the browser request-routing protections, allowing an attacker to send HTTP requests to internal resources (e.g., loopback, private IPs) via a crafted web page. The patch introduces a common URL validation routine for favicon retrieval, rejecting non-public destinations.
- CVE-2026-66913Medium
Lookyloo does not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker can submit a crafted archive that expands to a very large size, exhausting memory and causing denial of service.