{"id":"CVE-2025-66458","title":"Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other","summary":"Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, there are multiple XSS due to unsafe use of f-strings in Markup. The issue requires a malic…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"lookyloo","product":"lookyloo","affected":["lookyloo < 1.35.3"],"patched":["lookyloo 1.35.3"],"published":"2025-12-02","updated":"2026-09-25","sourceUpdated":"2026-09-25T23:10:00.463","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66458","references":[{"url":"https://github.com/Lookyloo/lookyloo/commit/b6ee2fee0afff0b35f37dd891bbce9d53ed8a290","label":"security-advisories@github.com"},{"url":"https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-58h2-652v-gq87","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00188,"epssPercentile":0.07521,"ingestedAt":"2026-09-25T23:21:16.865Z","slug":"CVE-2025-66458","body":"## Overview\n\nLookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, there are multiple XSS due to unsafe use of f-strings in Markup. The issue requires a malicious 3rd party server responding with a JSON document containing JS code in a script element. This vulnerability is fixed in 1.35.3.\n\n## Affected\n\n- `lookyloo < 1.35.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `lookyloo 1.35.3`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}