CVE-2026-66824

A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values derived from captured and potentially attacker-controlled web content, a specially crafted value could prematurely terminate the surrounding <script> element and inject arbitrary HTML or JavaScript. The malicious code would execute in the browser of a user viewing the affected capture tree. Successful exploitation could allow an attacker to perform actions using the victim’s authenticated session, access information available to the victim, or modify application data within the permissions of the affected user. The patch removes the JSON data from the HTML document and retrieves it through a dedicated API endpoint. The client then processes the response using response.json(), preventing capture data from being interpreted as executable content within the original page’s HTML or JavaScript context.

• CWE-79

• https://github.com/Lookyloo/lookyloo/commit/395187b57322ab311363ccc290c010b180389009

Published

Jul 27, 2026

Last Modified

Jul 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66807Stack-based buffer overflow in Microsoft Office allows an un…7.8
• CVE-2026-66808Deserialization of untrusted data in Microsoft Office ShareP…8.8
• CVE-2026-66809Out-of-bounds read in Microsoft Office allows an unauthorize…5.5
• CVE-2026-6681The PKCS#7 decode path ignores the caller-supplied output bu…5.3
• CVE-2026-66810Heap-based buffer overflow in Microsoft Office Word allows a…5.5
• CVE-2026-6682In FatFS R0.16 and earlier contains a FAT32 integer overflow…7.6
• CVE-2026-66825Pivotick contains a cross-site scripting vulnerability in th…6.9
• CVE-2026-66829URL Redirection to Untrusted Site ('Open Redirect') vulnerab…6.1
• CVE-2026-6683FatFs R0.16 and earlier contains a divide-by-zero in exFAT s…4.6
• CVE-2026-66832When the Mira Android app opens in-app WebView content (e.g.…6.9
• CVE-2026-66838Improper Neutralization of Special Elements used in an SQL C…5.9
• CVE-2026-66839NetKids iMark, provided by Integrated Systems Technologies, …8.4