CVE-2026-66824: Capture Tree Visualization XSS Vulnerability

CVE-2026-66824 Overview

CVE-2026-66824 is a stored cross-site scripting (XSS) vulnerability in the Lookyloo capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter, bypassing template auto-escaping. Because captured web content can contain attacker-controlled values, a crafted payload could prematurely terminate the surrounding <script> element and inject arbitrary HTML or JavaScript. The injected code executes in the browser of any authenticated user viewing the affected capture tree [CWE-79].

Critical Impact
Successful exploitation allows an attacker to act with the victim's authenticated session, read data available to the victim, or modify application state within the victim's permissions.

Affected Products

Lookyloo (open-source web capture analysis tool)
Versions prior to commit 395187b57322ab311363ccc290c010b180389009
Deployments serving the capture tree visualization page

Discovery Timeline

2026-07-27 - CVE-2026-66824 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66824

Vulnerability Analysis

Lookyloo is a web capture and analysis tool that renders the tree of URLs, resources, and responses collected during a capture. The vulnerability stems from unsafe server-side templating. The backend serialized the capture tree to JSON and injected it into the HTML response inside an inline <script> block using Jinja's safe filter, which disables auto-escaping.

Because capture tree nodes originate from remote, attacker-influenced web content (URLs, response bodies, headers), the serialized values can contain characters that break out of the JavaScript string context. A payload containing the literal string </script> terminates the inline script block early, letting the attacker inject arbitrary HTML or JavaScript into the rendered page.

Root Cause

The root cause is trusting captured, adversary-controlled data as safe content for direct HTML embedding. JSON serialization is not sufficient to make attacker-controlled data safe inside an HTML <script> tag, because HTML parsing rules take precedence over JavaScript string parsing when locating the closing </script> tag.

Attack Vector

An attacker hosts a page whose URL, DOM, or response contains a payload that includes </script> followed by an injected element or handler. When a Lookyloo user captures the attacker's site and then opens the tree visualization, the serialized tree containing the payload is embedded in the page and the injected code executes with the victim's session context.

python

# Security patch: expose tree JSON via API instead of inlining it into HTML
# Source: https://github.com/Lookyloo/lookyloo/commit/395187b57322ab311363ccc290c010b180389009

@api.route('/json/<uuid:capture_uuid>/tree_dump')
@api.doc(description='Get the json export to render the tree',
         params={'capture_uuid': 'The UUID of the capture'})
class TreeDump(Resource):  # type: ignore[misc]
    def get(self, capture_uuid: str) -> Response:
        try:
            cache = lookyloo.capture_cache(capture_uuid)
            if cache:
                return make_response(cache.tree.to_json())
            else:
                return make_response({'error': "Unable to get dump."}, 401)
        except Exception:
            return make_response({'error': "Unable to get dump."}, 401)

The patch removes the JSON dump from the HTML document and moves it behind a dedicated endpoint. The client fetches the data and parses it with response.json(), so capture data is never interpreted as executable content within the original page's HTML or JavaScript context.

Detection Methods for CVE-2026-66824

Indicators of Compromise

Captured pages containing </script> sequences, event-handler attributes, or <script> tags inside URLs, titles, or response bodies rendered by the tree view.
Outbound requests from analyst browsers to unexpected domains immediately after opening a capture tree.
Unexpected session activity, API calls, or data modifications originating from authenticated Lookyloo user accounts.
Modifications to captures or user settings that do not correlate with legitimate analyst actions.

Detection Strategies

Inspect served HTML for inline <script> blocks containing serialized capture data prior to patching.
Review web server and application logs for capture UUIDs whose tree pages produced browser errors or CSP violations.
Alert on browser Content Security Policy (CSP) violation reports referencing the tree visualization route.
Correlate analyst account activity with the specific captures opened to identify suspicious post-view actions.

Monitoring Recommendations

Enable and forward CSP report-uri or report-to telemetry for the Lookyloo web interface.
Monitor authenticated API calls that follow tree-view navigation for anomalous parameters or destinations.
Track deployed Lookyloo commit hashes across environments and flag any instance running code prior to 395187b.

How to Mitigate CVE-2026-66824

Immediate Actions Required

Update Lookyloo to a build that includes commit 395187b57322ab311363ccc290c010b180389009 or later.
Restart the Lookyloo service after deploying the patch to ensure the updated templates and API routes are loaded.
Rotate session cookies and any credentials that may have been exposed to analyst browsers viewing untrusted captures.
Audit recent captures from untrusted submitters for payloads targeting the tree visualization page.

Patch Information

The fix is available in the upstream Lookyloo repository. See the GitHub commit log for the full patch. The change removes the inline JSON dump from the HTML page and introduces a new /json/<uuid:capture_uuid>/tree_dump API endpoint that the client retrieves and parses with response.json(). Subresource integrity hashes for tree.js in website/web/sri.txt were updated accordingly.

Workarounds

Restrict access to the Lookyloo web interface to trusted analysts on isolated networks until the patch is applied.
Deploy a strict Content Security Policy that disallows inline scripts and unsafe event handlers on the tree visualization route.
Avoid opening tree visualizations of captures submitted by untrusted or anonymous users.

bash

# Pull and deploy the patched Lookyloo revision
cd /opt/lookyloo
git fetch origin
git checkout 395187b57322ab311363ccc290c010b180389009
poetry install
systemctl restart lookyloo