CVE-2026-75626: SpiderFoot Stored Cross-Site Scripting via Correlation Titles
SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Operators who open the correlations view for scans containing attacker-controlled external data are exposed. Relevant inputs include server banners and metadata collected from external scan data sources.
What does an attacker need to exploit it?
An attacker needs to cause malicious HTML with event handlers to be included in external scan data that SpiderFoot uses to build a correlation title. No SpiderFoot authentication or privileges are required for the attacker, but an operator must open the affected correlations view.
What is the likely impact if exploitation succeeds?
Successful exploitation can execute script in the operator's browser and may allow theft of API keys. The issue affects the browser session viewing the stored correlation result rather than requiring direct access to the SpiderFoot server.