CVE-2025-66460 Lookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to Datatables
Attacker can execute arbitrary scripts via unescaped HTML in Datatables, potentially leading to session hijacking or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-66460?
CVE-2025-66460 is a medium-severity cross-site scripting vulnerability in lookyloo, published on 2 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo passed improperly escaped values to cells rendered in datatables using the orthogonal-data feature. It is definitely exploitable from the popup view, but it is most probably also exploitable in many other places. This vulnerability is fixed in 1.35.3.
Weakness: CWE-79
Which versions are affected by CVE-2025-66460?
It affects 1 product.
Products include Lookyloo Lookyloo.
How do I fix CVE-2025-66460?
No fix has been published for CVE-2025-66460 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-66460 being exploited?
There is no known exploitation of CVE-2025-66460 in the wild and no public exploit code.
Other vulnerabilities in lookyloo
Sources
Also known as GHSA-r93r-7jfr-99c3.