以下是关于漏洞的关键信息 summary： Vulnerability Name: Multiple XSS due to unsafe use of f-strings in Markup Package: Lookylloo (Python) Affected Versions: <= 1.35.2 Patched Versions: 1.35.3 Severity: High (7.1/10) Impact: - The issue could be exploited by a malicious 3rd party server responding with a JSON document containing JS code in a element. - The tool uses f-strings directly in many other places, making it exploitable throughout the tool. Patches: - Update to v1.35.3 as soon as possible, especially for public instances. Workarounds: - Avoid having a public instance and interacting with any 3rd party systems. References: - Fix: b6ee2fe CVE ID: CVE-2025-66458 Weaknesses: CWE-80 CVSS v4 base metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Privileges Required: None - User interaction: Passive - Vulnerable System Impact Metrics: - Confidentiality: High - Integrity: None - Availability: None - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None