Lookyloo Multiple High-Severity Vulnerabilities (HTML Injection/XSS)

Critical Vulnerability Information 1. GCVE-1-2025-0018 Summary: An HTML injection issue has been identified in the helper function within Lookyloo's web interface ( ). This function is used to truncate and render user-controlled values within HTML (e.g., in attributes), but does not escape the string beforehand. This allows malicious input to inject HTML into the rendered page. In standard Lookyloo configurations, the configured Content Security Policy (CSP) significantly limits the impact and prevents direct script execution in most cases. However, if the CSP is relaxed or modified, the potential HTML injection vulnerability could be exploited. Severity: - Score: 9.4 (Critical) - Vector: CWE: CWE-74 - Special Elements Not Properly Neutralized in Downstream Component Output (Injection) Affected Products: - Vendor: Lookyloo 表: Lookyloo - Version: ≤ 1.35.0 --- 2. CVE-2025-65095 (GCVE-0-2025-65095) Summary: Lookyloo is a web interface that allows users to capture website pages and display domain trees. Prior to version 1.35.1, there was a potential Cross-Site Scripting (XSS) issue in the index and tree pages, which has been fixed in version 1.35.1. Severity: - Score: 9.4 (Critical) - Vector: CWE: CWE-79 - Input Not Properly Neutralized During Web Page Generation (Cross-Site Scripting) Affected Products: - Vendor: Lookyloo - Product: Lookyloo - Version: < 1.35.1

Goal Reached Thanks to every supporter — we hit 100%!

Lookyloo Multiple High-Severity Vulnerabilities (HTML Injection/XSS)