Medium severity · published Dec 2, 2025
CVE-2025-66459
Lookyloo vulnerable to XSS due to unescaped error message passed to innerHTML
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnerability can be triggered when a user submits a list of URLs to capture, one of them contains a HTML element, and the capture fails. Then, the error field is populated with an error message that contains the bad URL they tried to capture, triggering the XSS. This vulnerability is fixed in 1.35.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
lookyloo · Lookyloo
< 1.35.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66459
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66459
Patch
https://github.com/Lookyloo/lookyloo/commit/1850a34b8cec52438df3b544295b20cfa35f8ad1
Patch
https://github.com/Lookyloo/lookyloo/commit/8c3ab96de44c1ce15646d734aa06faf884329116
Patch
https://github.com/Lookyloo/lookyloo/commit/95cdc00fe37fd89790fa89bb3ee3fefa2da38442
Patch
https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-hvmh-j2jx-48wg
More from lookyloo
9.4
CVE-2025-65095
Lookyloo is vulnerable due to improper user input sanitization
9.2
CVE-2026-66824
Stored Cross-Site Scripting via Unsafe Capture Tree JSON Embedding
6.9
CVE-2026-55835
Lookyloo: Potential sub-system DoS due to parameter missmatch in notification
6.9
CVE-2026-66913
Zip Bomb in Lookyloo Capture Upload Allows Denial of Service
6.1
CVE-2025-66460
Lookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to Datatables