CVE-2026-75626: SpiderFoot XSS Vulnerability

CVE-2026-75626 Overview

CVE-2026-75626 is a stored Cross-Site Scripting (XSS) vulnerability in SpiderFoot, an open-source reconnaissance and OSINT automation platform. The flaw exists because SpiderFoot fails to HTML-escape correlation titles built from external scan data sources, including server banners and metadata. Attackers can inject HTML elements containing event handlers into correlation results. When an operator opens the correlations view, the injected script executes in the operator's browser session. Successful exploitation can lead to theft of API keys stored within the SpiderFoot interface. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in the operator's browser through malicious server banners captured during scans, exposing stored API keys and enabling session abuse.

Affected Products

SpiderFoot OSINT automation platform
SpiderFoot correlation engine (spiderfoot/correlation.py)
Web interface rendering scan correlation results

Discovery Timeline

2026-08-18 - CVE-2026-75626 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75626

Vulnerability Analysis

SpiderFoot performs automated reconnaissance and aggregates data from external sources such as HTTP server banners, DNS records, and other metadata. The correlation engine groups related findings into named result sets displayed in the web UI. The correlation title generation logic incorporates raw data collected from third-party targets without HTML entity encoding before rendering the values in the operator's browser. Because scan data flows from attacker-controlled infrastructure into a trusted operator console, this creates a persistent injection sink. An operator running a scan against attacker-owned infrastructure will unknowingly ingest hostile payloads that persist in the SpiderFoot database.

Root Cause

The root cause is missing output encoding in the correlation title rendering path within correlation.py and the associated view templates. Correlation titles derived from server responses and metadata are inserted into HTML markup without neutralizing characters such as <, >, and ". This allows attacker-supplied strings to break out of text context and introduce new HTML tags with executable event handlers such as onerror or onload.

Attack Vector

An attacker configures a web server or DNS record they control to return a banner or metadata field containing HTML markup with an event handler payload. When a SpiderFoot operator scans that target, the malicious banner is stored and used to build a correlation title. When the operator later opens the correlations view, the browser parses the injected markup and executes the attacker's JavaScript under the SpiderFoot origin, granting access to session data and stored API keys used for integrations with third-party OSINT providers.

A verified proof-of-concept payload is not available. See the VulnCheck SpiderFoot Advisory and GitHub Issue #2012 for further technical detail.

Detection Methods for CVE-2026-75626

Indicators of Compromise

Correlation titles or scan results containing HTML tags such as <img>, <svg>, <script>, or attributes like onerror= and onload=.
Unexpected outbound requests from operator browsers to unknown domains shortly after opening the SpiderFoot correlations view.
API key usage from unfamiliar source IP addresses on integrated OSINT services (Shodan, VirusTotal, etc.).

Detection Strategies

Inspect the SpiderFoot database for stored correlation titles containing angle brackets or JavaScript event-handler substrings.
Review web proxy or browser telemetry for script execution originating from the SpiderFoot host or port.
Correlate scan target lists with hosts returning unusually long or markup-laden server banners.

Monitoring Recommendations

Log and alert on modifications to stored SpiderFoot correlation records that include HTML metacharacters.
Monitor operator workstations for anomalous JavaScript execution and DOM changes when using the SpiderFoot UI.
Track API key usage patterns for third-party OSINT services referenced from the SpiderFoot configuration.

How to Mitigate CVE-2026-75626

Immediate Actions Required

Restrict access to the SpiderFoot web interface to trusted operator networks only, and require authentication in front of the UI.
Avoid opening the correlations view for scans of untrusted or attacker-influenced targets until a patched release is deployed.
Rotate API keys stored in SpiderFoot if the correlations view has been opened for scans against untrusted targets.

Patch Information

No fixed version is listed in the NVD entry at time of publication. Track the upstream project at the GitHub SpiderFoot Repository and monitor GitHub Issue #2012 for remediation status. Apply upstream patches to spiderfoot/correlation.py and any UI templates that render correlation titles as soon as they are available.

Workarounds

Place SpiderFoot behind a reverse proxy that enforces a strict Content Security Policy blocking inline scripts and event handlers.
Run SpiderFoot inside an isolated browser profile or virtual machine to contain any script execution from malicious scan data.
Sanitize or purge existing correlation records containing HTML metacharacters before viewing results collected from untrusted targets.

bash

# Example restrictive CSP header enforced by an upstream reverse proxy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none';";