Quick answers
- Is CVE-2026-66824 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-66824 being exploited in the wild.
- How severe is CVE-2026-66824?
- Informational severity, with a CVSS score of 9.2, published 27 July 2026.
- Which products and versions are affected?
- Lookyloo <= 1.40.0.
- Is there a fix for CVE-2026-66824?
- A patch was published on 2026-07-21: Fix committed to GitHub repository. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-66824 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-66824?
- Check whether you run Lookyloo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Lookyloo capture tree visualization page. The root cause is the insecure embedding of serialized capture tree data directly into an inline JavaScript block using the Jinja 'safe' filter, which bypasses automatic escaping. Because this data can contain attacker-controlled content from captured web pages, a malicious payload can terminate the <script> block and inject arbitrary HTML or JavaScript. An attacker can exploit this to perform actions on behalf of an authenticated user or access sensitive session information. The vulnerability is fixed in versions following 1.40.0 by moving the data to a dedicated API endpoint and processing it via response.json() on the client side.
Affected products
- Lookyloo Lookyloo <= 1.40.0
Timeline
- 2026-07-21: patched: Fix committed to GitHub repository.
- 2026-07-27: advisory: CVE published to NVD.