CVE-2025-66458CWE-79cross-site-scripting

CVE-2025-66458

Medium · published December 3, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
8.0
In the wild
Unconfirmed
What it is

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, there are multiple XSS due to unsafe use of f-strings in Markup. The issue requires a malicious 3rd party server responding with a JSON document containing JS code in a script element. This vulnerability is fixed in 1.35.3.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00188 · 8.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-03T00:15Z
Affected products (1)
ProductVersionsFixed in
lookyloo/lookyloo< 1.35.31.35.3
References (2)
https://github.com/Lookyloo/lookyloo/commit/b6ee2fee0afff0b35f37dd891bbce9d53ed8a290 · [email protected]https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-58h2-652v-gq87 · [email protected]
EPSS history
Timeline
  • 02 DEC 18:30Z
    Lookyloo has multiple XSS due to unsafe use of f-strings in Markup
    cvelistv5