CVE-2026-66824 Details

A stored cross-site scripting vulnerability has been identified in Lookyloo, specifically within the capture tree visualization page. The issue arises because the application directly embeds serialized capture tree data into an inline JavaScript block using the Jinja safe filter. This data can include values from captured web content, potentially controlled by attackers. By crafting a specific value, an attacker could terminate the surrounding <script> element and inject arbitrary HTML or JavaScript. The injected code would execute in the context of the user's browser, who is viewing the affected capture tree. Exploitation could allow the attacker to perform actions on behalf of the victim, access their information, or modify application data within the user's permissions.

The vulnerability has been patched by removing the JSON data from the HTML document and retrieving it through a dedicated API endpoint. The client processes the response using response.json(), which prevents the capture data from being executed as content within the page's HTML or JavaScript context.