CVE-2025-66460: Lookyloo XSS Vulnerability

CVE-2025-66460 Overview

CVE-2025-66460 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in Lookyloo, an open-source web interface for capturing website pages and displaying trees of domains that call each other. Versions prior to 1.35.3 pass improperly escaped values to cells rendered in datatables through the orthogonal-data feature. The flaw is confirmed exploitable from the popup view and likely reachable in additional rendering paths. An attacker can inject script content that executes in the browser of a user viewing captured data. The maintainers addressed the issue in Lookyloo 1.35.3.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of Lookyloo users, enabling session compromise, UI manipulation, and exfiltration of captured investigation data.

Affected Products

Lookyloo versions prior to 1.35.3
Deployments using the datatables orthogonal-data rendering feature
Instances exposing the popup view to untrusted capture content

Discovery Timeline

2025-12-02 - CVE-2025-66460 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66460

Vulnerability Analysis

Lookyloo renders capture data through DataTables, a JavaScript table library. The orthogonal-data feature lets developers supply different representations of the same value for display, sorting, and filtering. Lookyloo passed values into these rendered cells without adequate HTML escaping. Since Lookyloo processes attacker-controlled content, captured pages, URLs, headers, and cookies, an adversary can plant HTML or JavaScript payloads that execute when an analyst inspects the capture. The popup view is a confirmed sink, but the maintainers note the same unsafe rendering pattern likely exists in other views that reuse the affected rendering helper.

Root Cause

The root cause is missing output encoding when populating DataTables cells that use orthogonal-data. String values are inserted into the DOM as HTML rather than as text nodes, allowing markup injection. The upstream patch introduces dompurify version 3.3.0 as a client-side sanitization dependency and enforces type validation in URL paths to constrain untrusted input reaching rendering paths.

Attack Vector

An attacker controls a website that a Lookyloo user chooses to capture, or supplies a crafted URL, header, or response body that Lookyloo ingests. When an analyst opens the capture, particularly through the popup view, the injected payload renders in the DataTables cell and executes in the analyst's browser session. Exploitation requires user interaction to view the malicious capture but no authentication on the attacker's side.

python

# Patch excerpt from tools/3rdparty.py
# Adds DOMPurify to sanitize datatable cell content
 datatables_buttons_version = "3.2.5"
 datatables_select_version = "3.1.3"
 jquery_json_viewer_version = "1.5.0"
+dompurify_version = "3.3.0"


if __name__ == '__main__':
# Source: https://github.com/Lookyloo/lookyloo/commit/63b39311f6b251a671895d97174345faf1b18e6e

The patch adds DOMPurify 3.3.0 as a bundled dependency and enforces type checking on URL path parameters so untrusted strings are sanitized before reaching the DOM.

Detection Methods for CVE-2025-66460

Indicators of Compromise

Captured pages or DataTables cells containing raw <script>, onerror=, or javascript: payloads rendered without escaping
Unexpected outbound requests from analyst browsers to attacker-controlled domains after opening a Lookyloo popup view
Session or cookie exfiltration events correlated with Lookyloo access logs
Presence of Lookyloo instances running versions earlier than 1.35.3

Detection Strategies

Inventory Lookyloo deployments and compare installed versions against 1.35.3 using package or container image scans
Inspect HTTP responses served by Lookyloo for un-encoded HTML tags in DataTables cell payloads
Correlate browser telemetry with Lookyloo capture views to identify script execution originating from orthogonal-data cells

Monitoring Recommendations

Log and review access to Lookyloo popup and capture views, especially for captures fetched from untrusted or user-submitted URLs
Deploy Content Security Policy (CSP) headers on the Lookyloo host and alert on CSP violation reports
Monitor egress traffic from analyst workstations for beacons to unknown domains during Lookyloo sessions

How to Mitigate CVE-2025-66460

Immediate Actions Required

Upgrade Lookyloo to version 1.35.3 or later on every deployment
Restrict Lookyloo web access to authenticated internal users behind a VPN or reverse proxy with authentication
Instruct analysts to review captures in isolated browsers or dedicated virtual machines until upgrades complete

Patch Information

The fix is delivered in Lookyloo 1.35.3. The maintainers escaped values displayed in DataTables, bundled DOMPurify 3.3.0 for client-side sanitization, and enforced type validation on URL path parameters. Review the GitHub Security Advisory GHSA-r93r-7jfr-99c3 and the upstream commit 63b39311 for full patch details.

Workarounds

Disable public access to the popup view and other capture-rendering endpoints until upgrade
Apply a strict Content Security Policy that blocks inline scripts and restricts script sources
Isolate the Lookyloo browser session in a sandboxed profile with no access to sensitive credentials

bash

# Upgrade Lookyloo using Poetry to the patched release
cd /path/to/lookyloo
git fetch --tags
git checkout v1.35.3
poetry install
poetry run tools/3rdparty.py
# Restart the Lookyloo service after upgrade
systemctl restart lookyloo