Listen to this Post
The vulnerability exists in the error handling mechanism of Lookyloo’s URL capture submission feature. When a user provides a list of URLs for the application to capture, if one URL contains an embedded HTML element (like <script>) and the capture process fails, the application incorrectly uses the unsanitized, user-supplied URL to populate an error message. This error message is then rendered in the user’s browser. Since the malicious URL payload is not properly encoded or filtered before being reflected in the HTML output, the contained JavaScript is executed within the victim’s session context, leading to a reflected Cross-Site Scripting attack.
Platform: Lookyloo
Version: Prior to 1.35.3
Vulnerability: Reflected XSS
Severity: Medium
date: 2025-12-02
Prediction: 2025-12-15
What Undercode Say:
curl -X POST http://lookyloo.corp/capture -d “urls=https://legit.example,”
Check version
docker exec lookyloo_web python -c “import lookyloo; print(lookyloo.__version__)”
How Exploit:
Attacker crafts malicious URL containing script payload. Victim submits this URL via Lookyloo’s capture form. Capture fails, error page reflects and executes payload.
Protection from this CVE
Upgrade to 1.35.3. Sanitize all user-controlled inputs. Implement Content Security Policy.
Impact:
Session hijacking. Information leakage. Account takeover.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
