Overview
A critical stored cross-site scripting (XSS) vulnerability has been disclosed in SpiderFoot, the widely used open-source OSINT automation framework. Tracked as CVE-2026-75626 with a CVSS score of 9.3, the flaw allows attackers to inject malicious HTML into scan correlation results that execute in the operator's browser without any interaction beyond opening the correlations view.
SpiderFoot is used by penetration testers, threat intelligence analysts, and security operations teams to automate reconnaissance — making this class of vulnerability particularly impactful, as operators regularly ingest data from untrusted external sources.
Vulnerability Details
The root cause is a failure to HTML-escape correlation titles built from external scan data sources. SpiderFoot ingests data from sources such as server banners, DNS records, certificate metadata, and other host-derived artifacts. When these values are incorporated into correlation result titles, they are written directly into the HTML of the web interface without sanitization.
An attacker controlling a server that SpiderFoot scans can craft a malicious banner or metadata value containing HTML event handlers (e.g. onmouseover, onerror, onload). When the SpiderFoot operator opens the correlations view, the injected script executes in their browser session.
Attack vector:
- Attacker runs a server with a crafted HTTP
Server:banner or certificate CN containing a script payload - Operator runs a SpiderFoot scan that reaches the attacker-controlled host
- Operator opens the correlations view — injected script fires in the operator's browser
Impact: The XSS executes in the context of the operator's authenticated SpiderFoot session, potentially allowing:
- Session token theft
- Exfiltration of scan data and API keys stored in the interface
- Redirection to attacker-controlled pages
- Further lateral movement if SpiderFoot is deployed on an internal network
CVSS Breakdown
| Metric | Value |
|---|---|
| Base Score | 9.3 (Critical) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | Required (operator views correlations) |
| Scope | Changed |
| Confidentiality | High |
| Integrity | High |
| Availability | Low |
Affected Software
- SpiderFoot — all versions that do not apply the HTML-escaping fix to correlation title rendering
Remediation
- Apply the vendor patch as soon as it is released via the official SpiderFoot GitHub repository
- As an interim measure, avoid running SpiderFoot scans against untrusted or adversarial infrastructure until patched
- Restrict access to the SpiderFoot web interface to trusted networks only (do not expose to the internet)
- Review recent correlation views for suspicious content if you have scanned externally controlled hosts