External risk intelligence

Cross-Site Scripting in Capture Tree Visualization

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-66824

The vulnerability exists in a web-based visualization page used for inspecting captured web content. Such applications are typically deployed as web-based interfaces or services intended for user interaction, making them commonly accessible via a browser over a network, which aligns with typical deployment patterns for web applications and management consoles.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a stored cross-site scripting vulnerability in a web-based visualization page. The issue allows for the injection of malicious code that could execute in a user's browser, potentially enabling unauthorized actions or data access within the victim's session. The main concern is confirming relevance and exposure.

Code injection via web content.
Can access victim's session and data.
Confirm relevance and exposure to users.

Attack Path

How an attacker could exploit the issue

An attacker could inject malicious code into a web page by manipulating data displayed in the capture tree visualization. This occurs when the application embeds untrusted data directly into JavaScript, allowing specially crafted input to break out of the script context. When a user views the compromised visualization, the injected code executes in their browser, potentially leading to session hijacking or data manipulation.

Requires an attacker to control input data.
Malicious input within visualization data.
Risk of session hijacking and data modification.

Live Threat

Current exploitation, exposure, and threat context

A stored cross-site scripting vulnerability could allow an attacker to execute malicious code in a user's browser when they view a crafted capture tree. This could enable actions within the victim's authenticated session, access to information available to the victim, or modification of application data.

User session and data
Malicious input in capture tree
Unauthorized actions and data access

Operational Fix

Recommended remediation, mitigation, and detection steps

This stored cross-site scripting vulnerability impacts web applications processing user-provided data for visualization. The primary concern is the execution of arbitrary code within a user's browser session. Application owners and infrastructure teams are likely responsible for remediation, beginning with identifying all instances of the affected technology, assessing their exposure and criticality, and then planning a coordinated update.

Application and infrastructure teams own this.
Verify instance reachability and business impact.
Plan updates or implement vendor-provided fixes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the capture tree visualization page affected by CVE-2026-66824?

This component is part of an application used for inspecting and analyzing web content. It provides a visual representation of how a webpage was loaded, which helps users understand the structure of captured network data. Because it handles various web elements, it sometimes processes content that originates from external sources.

What is the nature of the vulnerability in CVE-2026-66824?

This is a Stored Cross-Site Scripting (CWE-79) vulnerability. It occurs because the application inserts captured tree data directly into the webpage's code. If the data contains specific characters, it can trick the browser into treating that data as active program code rather than plain text, allowing unauthorized commands to run.

How does an attacker trigger this vulnerability?

An attacker must ensure that malicious content is included within a capture tree. The bug does not trigger if the captured content consists of standard, safe web data. It only activates when a user views a specifically crafted capture tree that contains the malicious payload, which then executes automatically in their browser.

Is my instance of this technology at risk?

According to Halo Surface Signal, this vulnerability is likely relevant if your application is accessible via a web browser over a network. Because it is a web-based interface intended for interaction, any instance that can be reached by users is a potential target for this type of code injection.

How should I respond to this threat advisory?

Begin by identifying all instances of the software within your environment to understand your overall reachability. Coordinate with your infrastructure teams to assess the criticality of these instances. Your primary goal is to apply the provided vendor update, which replaces direct data embedding with a secure API request to prevent code execution.

References

github.com/Lookyloo/lookyloo/commit/395187b57322ab311363ccc290c0…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.