{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/spiderfoot/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-75626"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["spiderfoot"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["smicallef"],"content_html":"\u003cp\u003eSpiderFoot (versions 4.0 and earlier) contains a stored cross-site scripting (XSS) vulnerability (CVE-2026-75626) stemming from a failure to properly HTML-escape correlation titles. These titles are dynamically generated using data gathered from external scan sources, such as server banners and metadata. An attacker who can influence these external data sources - for example, by hosting a service that returns a malicious banner - can cause SpiderFoot to generate a correlation result containing injected HTML elements and JavaScript event handlers. When an operator accesses the correlations view in the SpiderFoot web interface, the malicious script executes in the context of the operator's session. This vulnerability poses a significant risk, as successful execution could allow for the exfiltration of sensitive information, including API keys stored within the application.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target organization using SpiderFoot for reconnaissance.\u003c/li\u003e\n\u003cli\u003eAttacker deploys a server or infrastructure controlled by them to be scanned by the target's SpiderFoot instance.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious server banner or metadata field containing an HTML payload (e.g., \u0026lt;img src=x onerror=alert(1)\u0026gt;).\u003c/li\u003e\n\u003cli\u003eThe target's SpiderFoot instance scans the attacker's infrastructure and ingests the malicious banner into its database.\u003c/li\u003e\n\u003cli\u003eSpiderFoot processes this data and creates a correlation entry, incorporating the unescaped malicious payload into the correlation title.\u003c/li\u003e\n\u003cli\u003eThe target's operator accesses the \u0026quot;Correlations\u0026quot; view in the SpiderFoot dashboard.\u003c/li\u003e\n\u003cli\u003eThe browser renders the malicious title, triggering the stored XSS payload in the operator's session context.\u003c/li\u003e\n\u003cli\u003eAttacker achieves execution of arbitrary JavaScript to steal session tokens or API keys.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to compromise the operator's session. Potential impacts include the theft of application-specific API keys, unauthorized access to the SpiderFoot instance, and the potential for pivoting into the operator's local environment through further browser-based attacks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate SpiderFoot to the latest available version that includes a patch for CVE-2026-75626.\u003c/li\u003e\n\u003cli\u003eImplement strict egress filtering to limit the external infrastructure the SpiderFoot instance can reach, reducing exposure to malicious scan targets.\u003c/li\u003e\n\u003cli\u003eMonitor web application logs for unexpected requests to the correlations view or unusual JavaScript execution patterns.\u003c/li\u003e\n\u003cli\u003eReview documentation for CVE-2026-75626 to identify specific mitigation steps provided by the maintainers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T12:51:10Z","date_published":"2026-08-18T12:51:10Z","id":"https://feed.craftedsignal.io/briefs/2026-08-spiderfoot-xss/","summary":"SpiderFoot versions 4.0 and earlier are vulnerable to stored cross-site scripting (XSS) due to improper HTML sanitization in correlation titles, allowing attackers to execute arbitrary JavaScript in an operator's browser.","title":"Stored Cross-Site Scripting in SpiderFoot via Correlation Titles","url":"https://feed.craftedsignal.io/briefs/2026-08-spiderfoot-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Spiderfoot","version":"https://jsonfeed.org/version/1.1"}