Attack Chain

1. Attacker identifies a target organization using SpiderFoot for reconnaissance.
2. Attacker deploys a server or infrastructure controlled by them to be scanned by the target's SpiderFoot instance.
3. Attacker crafts a malicious server banner or metadata field containing an HTML payload (e.g., <img src=x onerror=alert(1)>).
4. The target's SpiderFoot instance scans the attacker's infrastructure and ingests the malicious banner into its database.
5. SpiderFoot processes this data and creates a correlation entry, incorporating the unescaped malicious payload into the correlation title.
6. The target's operator accesses the "Correlations" view in the SpiderFoot dashboard.
7. The browser renders the malicious title, triggering the stored XSS payload in the operator's session context.
8. Attacker achieves execution of arbitrary JavaScript to steal session tokens or API keys.

Impact

Successful exploitation of this vulnerability allows an attacker to compromise the operator's session. Potential impacts include the theft of application-specific API keys, unauthorized access to the SpiderFoot instance, and the potential for pivoting into the operator's local environment through further browser-based attacks.

Recommendation

Prioritized actions for security teams:

• Update SpiderFoot to the latest available version that includes a patch for CVE-2026-75626.
• Implement strict egress filtering to limit the external infrastructure the SpiderFoot instance can reach, reducing exposure to malicious scan targets.
• Monitor web application logs for unexpected requests to the correlations view or unusual JavaScript execution patterns.
• Review documentation for CVE-2026-75626 to identify specific mitigation steps provided by the maintainers.