External risk intelligence

SpiderFoot Correlation Title Cross-Site Scripting Leading to API Key Theft.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-75626

SpiderFoot is a self-hosted OSINT tool typically operated internally. While it often includes a web interface, it is usually deployed behind organizational controls or firewalls. Internet reachability is possible depending on the user's deployment configuration, but it is not the default or intended state for this software.

Cross-site Scripting

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

SpiderFoot, an open-source intelligence tool, has a vulnerability that could allow attackers to inject malicious scripts into browser views, potentially leading to the theft of API keys. This issue arises from the tool's failure to properly escape external data used in correlation titles.

Malicious scripts can run in your browser.
Stealing API keys poses significant risks.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could start by sending specially crafted data to SpiderFoot, which might come from external scanning tools. If the operator views the correlation results containing this data, malicious code embedded within it could automatically run in their browser. This could lead to the theft of sensitive information like API keys.

No authentication or privileges needed.
Viewing correlations triggers malicious scripts.
Risk of API key theft.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could expose sensitive information, such as API keys, when an attacker injects malicious HTML into correlation titles. This occurs when external scan data is processed, and the malicious content is then executed in the operator's browser when viewing the correlations.

API keys may be exposed.
Malicious scripts execute in the browser.
Compromised operator session.

Operational Fix

Recommended remediation, mitigation, and detection steps

The SpiderFoot application's failure to properly escape external data in correlation titles presents a critical cross-site scripting risk. Owners of the SpiderFoot application, likely security or operations teams, must first identify all instances of the tool, confirm their external reachability, and assess business criticality. Following this, a plan for remediation, potentially involving vendor coordination or temporary risk reduction, should be developed based on the assessed risk.

Identify SpiderFoot instances and ownership.
Verify external reachability and business impact.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SpiderFoot and how is it used?

SpiderFoot is an open-source intelligence (OSINT) automation tool. Security teams use it to aggregate data from hundreds of public sources to map an organization's digital footprint. It processes vast amounts of server banners, domain metadata, and other external reconnaissance signals to correlate information and help analysts identify potential security risks.

How does CVE-2026-75626 work?

This vulnerability is a Cross-Site Scripting (XSS) weakness, categorized as CWE-79. It occurs because the software fails to sanitize external data before displaying it. When SpiderFoot builds correlation titles from raw scan data, it does not strip out HTML or script tags, allowing an attacker to inject malicious code that the browser interprets as a legitimate part of the interface.

How is this vulnerability triggered?

The vulnerability is triggered when an operator views the correlation results page containing the injected malicious data. Importantly, simply having the data inside the database does not execute the attack; the malicious script only runs when the browser renders the unsanitized correlation title. Direct interaction with the web interface is required for the code to execute.

Is my SpiderFoot instance at risk?

Halo Surface Signal indicates that while SpiderFoot is typically an internal tool, its reachability depends on your specific deployment. If you have exposed the web interface to the internet, your risk profile is higher. You should assess whether your instance is accessible to untrusted networks or if it is restricted behind organizational firewalls and access controls.

What should I do to address this risk?

Start by identifying all active SpiderFoot instances within your infrastructure and determining who owns them. Verify the current network configuration to confirm if these instances are exposed to external traffic. Once you understand your footprint, assess the criticality of the data handled by these instances and develop a plan to restrict access or apply updates as they become available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.