A critical stored cross-site scripting vulnerability in lookyloo allows attackers to execute arbitrary JavaScript in the browsers of other users, potentially leading to session hijacking.

The application improperly handled serialized capture tree data by embedding it directly into an inline JavaScript block using the Jinja safe filter. An unauthenticated attacker can supply crafted content that terminates the script element to inject malicious HTML or JavaScript.

With a CVSS score of 9.2, this vulnerability poses a significant risk to user integrity and session security. Successful exploitation enables attackers to steal sensitive session information, perform actions on behalf of authenticated users, or modify application data, potentially leading to unauthorized access to internal tools.

Immediate Action: Update to the latest version of lookyloo as soon as it becomes available, as the official fix involves migrating data handling to a secure JSON API endpoint.

Proactive Monitoring: Monitor user activity and browser logs for unusual script execution or unauthorized interactions within the capture tree visualization interface.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of inline scripts and prevent unauthorized data exfiltration from the browser.

Public Exploit Available: No confirmed public exploit.

This vulnerability represents a high-risk entry point for cross-site scripting attacks. Security teams should prioritize patching once the vendor releases the update and ensure that access to the lookyloo instance is restricted to trusted users to minimize the impact of potential exploitation.