Stored Cross-Site Scripting Vulnerability in Lookyloo Web Application

CVE-2026-66824

What is CVE-2026-66824?

The Lookyloo web application has a stored cross-site scripting vulnerability due to improper handling of the capture tree visualization page. By embedding serialized tree data directly into an inline JavaScript block using the Jinja safe filter, the application exposes itself to potential attacks. This flaw allows an attacker to inject malicious HTML or JavaScript into a user's browser when the capture tree is viewed. The attacker can exploit this vulnerability to execute arbitrary actions within the user's authenticated session, access sensitive information, or alter data based on the user’s permissions. The applied patch effectively mitigates this vulnerability by retrieving the JSON data through a dedicated API endpoint, which ensures the data is securely processed and prevents it from being executed as part of the HTML or JavaScript context.

References