CRITICAL 9.3 NVD
CVE-2026-75626
SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious H
SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.
References
- https://github.com/smicallef/spiderfoot
- https://github.com/smicallef/spiderfoot/blob/master/spiderfoot/correlation.py
- https://github.com/smicallef/spiderfoot/issues/2012
- https://www.vulncheck.com/advisories/spiderfoot-stored-cross-site-scripting-via-correlatio
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-08-18 via NVD.
Risk Timeline
CVE Disclosed2026-08-18 · -1 days ago
Remediation Resources
vulnfeed aggregates 11001 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.