RansomLook stores cryptocurrency addresses and blockchain names directly in a database field that is later rendered in an inline JavaScript onclick handler on the wallet detail page. This is a Stored XSS vulnerability, classified as CWE-79. The input is not validated and the Jinja template engine’s autoescaping does not protect against script injection when the data is used inside a JavaScript string. As a result a malicious address containing quote characters and JavaScript syntax can break out of the string literal and execute arbitrary code when a user clicks the CSV export button. If executed, the attacker’s script runs in the RansomLook web application context, enabling disclosure of sensitive data, session hijacking, or other actions with the victim’s privileges.

The vulnerable product is RansomLook. The vendor is identified as ransomlook, and the product is referred to simply as RansomLook. No specific version or release information was provided in the CVE record, so the risk applies to all deployments that use the software before the issued patch.

The CVSS 8.8 score suggests that a successful exploitation could lead to a wide range of attack outcomes, from data theft to defacement. In absence of active exploitation data, administrators should treat the vulnerability as a high‑priority threat due to the potential impact and ease of deployment via external inputs.