EUVD-2026-60577
GHSA-26xf-786q-vrw9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Payload injected via unauthenticated external scan data (PR:N) but execution needs the operator to open the view (UI:R); browser-context execution changes scope (S:C) and steals API keys (C:H) with limited integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.
AnalysisAI
Stored cross-site scripting in SpiderFoot (smicallef) lets attacker-controlled reconnaissance data execute JavaScript in an operator's browser. Because correlation titles are assembled from external scan inputs such as server banners and service metadata without HTML-escaping, an attacker who controls a scanned target can persist an HTML event-handler payload that fires when the operator opens the correlations view, enabling theft of stored API keys and session-context actions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker control or influence data that SpiderFoot ingests during a scan - specifically a server banner, service response, or metadata field on a target the operator scans - and that this value flow into a generated correlation title via correlation.py. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/SC:H/SI:H) yields a 9.3 and reflects a genuinely serious stored-XSS chain: no authentication is needed to inject (the attacker only needs to control data that a target-side scan will ingest), and the high subsequent-system impact captures code running in the trusted operator browser context where API keys live. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker configures a server they control so that a banner, HTTP header, or metadata field returns a crafted string like an <img> tag with an onerror handler. When a SpiderFoot operator scans that target, the value is stored and later surfaced in a correlation title; opening the correlations view executes the attacker's script in the operator's session and exfiltrates configured API keys. … |
| Remediation | No vendor-released patch identified at time of analysis, so no exact fixed version can be cited; monitor GitHub issue 2012 and the smicallef/spiderfoot repository for a released fix that adds HTML-output encoding to correlation titles in correlation.py, and review the VulnCheck advisory (https://www.vulncheck.com/advisories/spiderfoot-stored-cross-site-scripting-via-correlation-titles) for updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict network access to SpiderFoot instances and rotate all API keys, cloud credentials, and authentication tokens managed through or accessible from SpiderFoot. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today