{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "lookyloo",
          "vendor": "lookyloo",
          "versions": [
            {
              "lessThanOrEqual": "1.35.0",
              "status": "affected"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA HTML injection issue was identified in Lookyloo\u2019s web interface helper function \u003ccode\u003eshorten_string\u003c/code\u003e\u0026nbsp;(\u003ccode\u003ewebsite/web/__init__.py\u003c/code\u003e). The function was used to truncate and render user-controlled values inside HTML (for example in a \u003ccode\u003e\u0026lt;span title=\"...\"\u0026gt;\u003c/code\u003e\u0026nbsp;attribute) without first escaping the string. This allowed crafted input containing HTML to be injected into the rendered page.\u003c/p\u003e\u003cp\u003eOn a standard Lookyloo installation, the configured Content Security Policy (CSP) significantly limited the impact and prevented direct script execution in most scenarios, but the underlying HTML injection bug was still present and could become exploitable if CSP was relaxed or modified.\u003c/p\u003e"
            }
          ],
          "value": "A HTML injection issue was identified in Lookyloo\u2019s web interface helper function shorten_string\u00a0(website/web/__init__.py). The function was used to truncate and render user-controlled values inside HTML (for example in a \u003cspan title=\"...\"\u003e\u00a0attribute) without first escaping the string. This allowed crafted input containing HTML to be injected into the rendered page.\n\nOn a standard Lookyloo installation, the configured Content Security Policy (CSP) significantly limited the impact and prevented direct script execution in most scenarios, but the underlying HTML injection bug was still present and could become exploitable if CSP was relaxed or modified."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Lookyloo/lookyloo/commit/ac2f73dbfcad88b815b18c42cca77a1c645f1726"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-m9g6-23c8-vrxf"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "HTML injection issue was identified in Lookyloo\u2019s web interface helper function",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "If you don\u0027t upgrade, a proper CSP policy will avoid this vulnerability."
            }
          ],
          "value": "If you don\u0027t upgrade, a proper CSP policy will avoid this vulnerability."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2025-65095",
    "datePublished": "2025-11-18T15:33:00.000Z",
    "dateUpdated": "2025-11-18T20:39:45.579295Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2025-0018",
    "vulnerabilitylookup_history": [
      [
        "alexandre.dulaunoy@circl.lu",
        "2025-11-18T15:33:07.767301Z"
      ],
      [
        "alexandre.dulaunoy@circl.lu",
        "2025-11-18T15:49:02.564916Z"
      ],
      [
        "alexandre.dulaunoy@circl.lu",
        "2025-11-18T20:39:45.579295Z"
      ]
    ]
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}