RansomLook vulnerabilities
We track 13 vulnerabilities in RansomLook products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on August 24, 2026.
Latest RansomLook vulnerabilities
- 9.4 Critical severity
ransomlook: Exposure of Sensitive Information to an Unauthorized Actor
RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/
- 7.0 High severity
ransomlook: Incorrect Default Permissions
RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secret_key file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequentl
- 8.8 High severity
ransomlook: Improper Restriction of Excessive Authentication Attempts
RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local a
- 8.8 High severity
ransomlook: Improper Neutralization of Input During Web Page Generation
RansomLook contains a stored cross-site scripting (XSS) vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored w
- 9.4 Critical severity
ransomlook: Missing Authorization
RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check befor
- 8.7 High severity
ransomlook: Exposure of Sensitive Information to an Unauthorized Actor
RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets were returned largely verbatim to unauthenticated callers whenever the location its
- 8.2 High severity
ransomlook: Server-Side Request Forgery
RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, all
- 8.2 High severity
ransomlook: Improper Limitation of a Pathname to a Restricted Directory
RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the database-controlled screen value directly with the application's source/ directory and opens the
- 8.7 High severity
ransomlook: Missing Authorization
RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify
- 9.2 Critical severity
ransomlook: Missing Authorization
RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through sever
- 9.2 Critical severity
ransomlook: Missing Authorization
RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/<database> endpoint permits selected internal databases to be expo
- 8.8 High severity
ransomlook: Missing Authentication for Critical Functionality
RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism
- 7.5 High severity
RansomLook: Exposure of Sensitive Information to an Unauthorized Actor
RansomLook is a tool to monitor Ransomware groups and markets and extract their victims. Prior to 1.9.0, the API in the affected application improperly filters private location entries in website/web/api/genericapi.py. Because the code removes elements from a