Lookyloo vulnerabilities
We track 4 vulnerabilities in Lookyloo products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on July 27, 2026.
Latest Lookyloo vulnerabilities
- 9.2 Critical severity
lookyloo: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values deri
- 7.1 High severity
PlaywrightCapture stored capture-specific configuration and runtime data as mutable…
PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, multiple Capture objects running within the same Python process could share state, including HTTP head
- 7.5 High severity
PlaywrightCapture: Server-Side Request Forgery
PlaywrightCapture is a simple replacement for splash using playwright. Prior to 1.39.6, PlaywrightCapture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirect
- 9.4 Critical severity
lookyloo: Improper Neutralization of Input During Web Page Generation
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.35.1, there is potential cross-site scripting on index and tree page. This issue has been patched in version 1.3