CVE-2025-66460
📋 TL;DR
Lookyloo versions before 1.35.3 contain a cross-site scripting (XSS) vulnerability where improperly escaped values are passed to datatable cells. This allows attackers to execute arbitrary JavaScript in users' browsers when viewing captured website data. Anyone running Lookyloo instances accessible to untrusted users is affected.
💻 Affected Systems
- Lookyloo
📦 What is this software?
Lookyloo by Lookyloo
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or compromise user accounts through client-side attacks.
Likely Case
Attackers inject malicious JavaScript that steals session tokens or credentials from users viewing Lookyloo data, leading to account compromise.
If Mitigated
With proper input validation and output encoding, the XSS payloads would be rendered harmless as text rather than executable code.
🎯 Exploit Status
Exploitation requires user interaction (viewing malicious data in Lookyloo), but no authentication is needed to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.35.3
Vendor Advisory: https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-r93r-7jfr-99c3
Restart Required: Yes
Instructions:
1. Update Lookyloo to version 1.35.3 or later using pip: 'pip install --upgrade lookyloo==1.35.3' 2. Restart the Lookyloo service 3. Verify the update was successful
🔧 Temporary Workarounds
Disable popup views
allTemporarily disable the vulnerable popup view functionality if it's not essential
Content Security Policy
allImplement strict Content Security Policy headers to mitigate XSS impact
🧯 If You Can't Patch
- Restrict access to Lookyloo instances to trusted users only
- Implement web application firewall rules to block XSS payload patterns
🔍 How to Verify
Check if Vulnerable:
Check Lookyloo version: 'lookyloo --version' or examine package version in Python environmentCheck Version:
lookyloo --versionVerify Fix Applied:
Confirm version is 1.35.3 or later and test that datatable cells properly escape HTML content📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript execution in Lookyloo interface logs
- Suspicious characters in datatable cell content
Network Indicators:
- Malicious script tags in HTTP responses from Lookyloo
SIEM Query:
source="lookyloo" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=")