SpiderFoot versions up to and including 4.0 fail to HTML-escape correlation titles built from external scan data, allowing attackers to execute scripts in an operator's browser and potentially steal API keys.
What Is It
CVE-2026-75626 is a stored cross-site scripting flaw (CWE-79) in SpiderFoot, the open-source OSINT automation platform. SpiderFoot does not HTML-escape correlation titles that are constructed from external scan data sources; including server banners and metadata. An attacker who controls that external data can inject malicious HTML elements carrying event handlers into correlation results. When the operator later opens the correlations view, the injected script executes in their browser session.
The flaw is rated 9.3 (Critical). The accompanying vector string, CVSS:4.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, carries a CVSS 4.0 version prefix but is composed entirely of CVSS 3.1 base metrics, most conspicuously S:C, a scope metric that CVSS 4.0 does not define. The defect is in the version label, not in the score: read as a CVSS 3.1 vector, the string is well-formed and recomputes to exactly 9.3, matching the published figure. The metrics themselves describe the exploitation path accurately, network-reachable, low attack complexity, no privileges required, and user interaction required, since the operator must open the correlations view. High confidentiality and integrity impact are asserted, with no availability impact, and scope is changed because the injected script executes outside the vulnerable component's own security authority. Expect the version prefix to be corrected, or a genuine CVSS 4.0 vector to be issued, during NVD enrichment; the 9.3 severity itself is sound as scored.
Why It Matters
The attack surface here is inverted from a typical web XSS: the payload arrives through the reconnaissance target. SpiderFoot's job is to ingest untrusted data from the internet, so an adversary who anticipates being scanned can seed a poisoned server banner or metadata field and wait. Execution occurs in the context of the analyst's own browser, against a tool that by design holds credentials for numerous third-party intelligence services. The NVD description explicitly notes the potential for stealing API keys; turning a scan of a hostile target into a credential compromise of the operator's tooling.
What's Vulnerable
- Vendor: smicallef
- Product: SpiderFoot
- Affected versions: all versions up to and including 4.0 (default status: unaffected outside this range)
- Relevant component:
spiderfoot/correlation.py
Patch Status
The supplied source material does not identify a fixed version, patch commit, or vendor remediation guidance. The record was published 2026-08-18 with a vulnerability status of "Received," meaning NVD enrichment is not yet complete and the metadata, including the mislabeled vector prefix noted above, may still be revised. There is no CISA KEV entry for this CVE in the supplied data; active exploitation is not confirmed, and no federal required-action deadline applies. Operators should track the linked GitHub issue and VulnCheck advisory for fix availability.
Sources
- NVD, CVE-2026-75626 (source: [email protected])
- VulnCheck Advisory; SpiderFoot Stored Cross-Site Scripting via Correlation Titles: https://www.vulncheck.com/advisories/spiderfoot-stored-cross-site-scripting-via-correlation-titles
- SpiderFoot GitHub Repository: https://github.com/smicallef/spiderfoot
- SpiderFoot
correlation.py: https://github.com/smicallef/spiderfoot/blob/master/spiderfoot/correlation.py - SpiderFoot GitHub Issue #2012: https://github.com/smicallef/spiderfoot/issues/2012