CVE-2026-75626
Received Received - Intake

SpiderFoot HTML Injection via External Scan Data Correlation

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75626
EUVD
EUVD-2026-60577

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
smicallef spiderfoot to 4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-75626 is a stored cross-site scripting (XSS) vulnerability in SpiderFoot versions up to 4.0. It occurs in the correlation engine where titles derived from external scan data like server banners are not properly HTML-escaped. Attackers can inject malicious HTML with event handlers into correlation results. When operators view these correlations, the scripts execute in their browsers, potentially stealing sensitive data such as API keys.

Detection Guidance

To detect this vulnerability, inspect SpiderFoot correlation titles for unexpected HTML or JavaScript content. Check server banners, metadata, and correlation results for unescaped scripts. Review logs for suspicious payloads in correlation data sources.

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in the operator's browser when viewing correlation results. This could lead to theft of API keys, unauthorized access to the UI, ability to start/stop/delete scans, or modify settings. Since SpiderFoot stores plaintext API keys by default, attackers could gain full control over the application and its data.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Exposure of API keys or other credentials may result in compliance breaches, potential data breaches, and failure to meet security and privacy standards.

Mitigation Strategies

Upgrade SpiderFoot to a version beyond 4.0. Disable authentication if not needed. Avoid using untrusted data sources. Review and sanitize all correlation titles. Monitor for unauthorized API key access or unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75626. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart