CVE-2025-66458: Lookyloo XSS Vulnerability

CVE-2025-66458 Overview

CVE-2025-66458 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Lookyloo, a web interface that captures website pages and displays a tree of domains that call each other. Versions prior to 1.35.3 contain multiple XSS flaws caused by unsafe use of Python f-strings inside Markup objects. Exploitation requires a malicious third-party server to respond with a JSON document containing JavaScript embedded in a <script> element. When Lookyloo processes and renders that data, the injected script executes in the user's browser session. The maintainers fixed the issue in version 1.35.3.

Critical Impact
Attackers controlling third-party responses can execute arbitrary JavaScript in Lookyloo users' browsers, compromising confidentiality and integrity of the analysis interface.

Affected Products

Lookyloo versions prior to 1.35.3
Deployments capturing responses from untrusted third-party servers
Lookyloo web interface rendering JSON documents into templated views

Discovery Timeline

2025-12-02 - CVE-2025-66458 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66458

Vulnerability Analysis

The vulnerability stems from unsafe interpolation of untrusted data into Markup objects using Python f-strings. In Jinja2 and Flask-based applications, values wrapped in Markup are treated as safe HTML and bypass the default auto-escaping performed by the templating engine. When Lookyloo builds such strings via f-strings that include data pulled from a captured third-party HTTP response, any HTML or JavaScript in that data is rendered directly by the browser.

Exploitation requires a captured third-party server to respond with a JSON body containing a <script> element or other executable HTML. When a Lookyloo user opens the analysis view for a capture that touched the malicious server, the injected script runs under the origin of the Lookyloo instance. The attacker can then read DOM content, exfiltrate capture data, or perform actions on behalf of the authenticated analyst.

Root Cause

The root cause is combining Python f-string interpolation with Markup wrapping, which explicitly disables output escaping. Any external content placed into the format string is emitted as raw HTML, defeating Jinja2's XSS protections.

Attack Vector

The attack requires user interaction: an analyst must load a Lookyloo capture that includes a response from an attacker-controlled server. The malicious server returns a JSON document embedding a <script> tag, which Lookyloo's rendering path outputs unescaped. See the GitHub Security Advisory GHSA-58h2-652v-gq87 for full technical details.

Detection Methods for CVE-2025-66458

Indicators of Compromise

Captured JSON responses from third-party hosts that contain <script> tags or event-handler attributes such as onerror and onload.
Browser console errors or unexpected network requests originating from the Lookyloo analysis page.
Lookyloo deployments running versions prior to 1.35.3 as reported by the /api/v1/info endpoint or release metadata.

Detection Strategies

Review Lookyloo capture archives for stored JSON payloads containing script elements or JavaScript URI schemes.
Monitor outbound requests from analyst browsers viewing Lookyloo pages for connections to unknown domains that could indicate successful script execution.
Correlate Lookyloo web server access logs with capture identifiers to detect analysts opening captures sourced from suspicious domains.

Monitoring Recommendations

Enable a strict Content Security Policy on the Lookyloo host to log and block inline script execution.
Alert on Lookyloo container or process upgrades that fail to reach version 1.35.3 or later.
Track third-party domain reputation in captures using threat intelligence feeds.

How to Mitigate CVE-2025-66458

Immediate Actions Required

Upgrade Lookyloo to version 1.35.3 or later using the maintainer's release channel.
Restrict access to the Lookyloo interface to trusted analysts and networks until patched.
Instruct analysts to avoid opening captures of unknown or untrusted URLs on unpatched instances.

Patch Information

The fix is delivered in Lookyloo 1.35.3. The corrective change is available in the upstream commit b6ee2fee0afff0b35f37dd891bbce9d53ed8a290, which removes the unsafe f-string usage inside Markup and restores proper escaping.

Workarounds

Deploy a Content Security Policy that disallows inline scripts on the Lookyloo web origin.
Place Lookyloo behind a reverse proxy that strips or sanitizes <script> tags in rendered HTML responses.
Isolate the Lookyloo analyst browser in a dedicated profile or virtual machine to limit blast radius.

bash

# Configuration example
pip install --upgrade "lookyloo>=1.35.3"
# Verify installed version
python -c "import lookyloo; print(lookyloo.__version__)"