Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

Summary Crass's tokenizer didn't terminate a bad URL token at a that followed an escaped backslash \. As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing...

GHSA-PQ4G-8RXF-4G29 Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

Summary Crass's tokenizer didn't terminate a bad URL token at a that followed an escaped backslash \. As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing...

Fedora 42 : tuxanci (2026-c76c93c411)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c76c93c411 advisory. This release removes bad URL tag from the package. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note tha...

CVE-2025-66459

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnerability can be triggered when a user submits a list of URLs to capture, one of them contains a HTML element, and the capture fails. Then, t...

PT-2025-48752

Name of the Vulnerable Software and Affected Versions Lookyloo versions prior to 1.35.3 Description Lookyloo is a web interface used to capture website pages and display a tree of domains that interact with each other. A cross-site scripting XSS issue can occur when a user submits URLs for captur...