Listen to this Post
CVE-2025-66460 is a Cross-Site Scripting (XSS) vulnerability in Lookyloo, a web interface for capturing and analyzing website domains. The vulnerability occurs in versions prior to 1.35.3 due to improper escaping of user-supplied data when rendering cells in datatables using the orthogonal-data feature. Orthogonal-data allows for different data representations in tables, but Lookyloo fails to sanitize input before passing it to these cells. When malicious JavaScript code is injected into the data processed by Lookyloo, such as through crafted website entries or user inputs, it is not escaped and is executed in the victim’s browser upon rendering. This is confirmed exploitable from the popup view where user-controlled data is displayed, and likely in other parts of the application. Attackers can leverage this by tricking users into viewing a maliciously crafted page within Lookyloo, leading to arbitrary script execution. The vulnerability requires user interaction, as the victim must interact with the compromised interface, but it can be used to steal session cookies, redirect users, or perform actions on behalf of the user. The issue stems from inadequate input validation and output encoding in the datatable rendering logic. Fixes in version 1.35.3 ensure proper escaping of all values before they are rendered, mitigating the XSS risk.
Platform: Lookyloo
Version: Prior to 1.35.3
Vulnerability: Cross-Site Scripting
Severity: Medium
date: 2025-12-02
Prediction: Patched in 1.35.3
What Undercode Say:
Showing bash commands and codes related to the blog
– Check version: `lookyloo –version`
– Update Lookyloo: `pip install lookyloo==1.35.3`
– XSS payload example: ``
how Exploit:
Craft malicious data with JavaScript payloads injected into Lookyloo’s processed website inputs, then lure victims to view the datatable popup or affected pages, triggering script execution in their browser sessions.
Protection from this CVE
Upgrade to Lookyloo version 1.35.3 or later, ensuring proper input sanitization and output encoding in datatable orthogonal-data features.
Impact:
Session hijacking, data theft, unauthorized actions via client-side script execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
