Lookyloo Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Lookyloo, a web interface for capturing and analyzing website pages. This issue affects Lookyloo versions through 1.35.2 and stems from the unsafe use of f-strings in Markup, which allowed a malicious third-party server to inject JavaScript code via a JSON response. The vulnerability is exploitable across the tool, particularly when interacting with third-party systems.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users are advised to update to Lookyloo version 1.35.3, where this vulnerability has been patched. If running a public instance, it is crucial to update as soon as possible.