Back to Database
Status published
Medium
CVE-2025-66458
Lookyloo has multiple XSS due to unsafe use of f-strings in Markup
Vulnerability Description
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, there are multiple XSS due to unsafe use of f-strings in Markup. The issue requires a malicious 3rd party server responding with a JSON document containing JS code in a script element. This vulnerability is fixed in 1.35.3.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66458
Credits & Attribution
No credits recorded in the NVD database.
References
More from Lookyloo
View All →CVE-2025-66460
Lookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to Datatables
Medium
5.3
CVE-2025-66459
Lookyloo vulnerable to XSS due to unescaped error message passed to innerHTML
Medium
5.3
CVE-2025-65095
Lookyloo is vulnerable due to improper user input sanitization
Critical
9.4
Affected Vendor
Lookyloo
View all reports →Affected Software
lookyloo
Vulnerable Versions:
< 1.35.3
Timeline
Official Publish:
December 2nd, 2025
Last Modified:
December 2nd, 2025
Added to House:
July 22nd, 2026