SpiderFoot Stored XSS via Unsanitized Correlation Titles

Technical Analysis

CVE-2026-75626 is a stored cross-site scripting (XSS) vulnerability (CVSS 9.3) rooted in SpiderFoot's failure to HTML-escape correlation titles constructed from attacker-influenced scan inputs like server banners and DNS/WHOIS metadata. An attacker who controls or influences a scanned target's exposed metadata can embed HTML elements with event handlers (e.g., onerror, onload) into these fields; when SpiderFoot generates correlation results, this payload is rendered unescaped in the operator's browser context, leading to script execution. This grants the attacker access to the browser's DOM, including any session storage, local storage, or cookies holding SpiderFoot API keys, module credentials, or third-party OSINT service tokens configured within the tool. Because SpiderFoot is frequently integrated into automated reconnaissance pipelines and AI-driven agent workflows (e.g., autonomous OSINT/recon agents that ingest SpiderFoot output or trigger scans programmatically), a compromised operator session or exfiltrated API key could allow attackers to pivot into connected agent tooling, hijack downstream API calls, or poison data fed into RAG/agent decision pipelines, making this agent-relevant despite being a classic web XSS flaw.

Affected Systems

SpiderFoot OSINT automation tool - all versions prior to the patched release addressing correlation title escaping; deployments using the web UI correlations view; installations with API keys for third-party intelligence sources (Shodan, VirusTotal, etc.) stored in the application

Indicators of Compromise

• N/A - vulnerability class (stored XSS); no known malicious samples or infrastructure published at time of disclosure. Monitor for anomalous correlation titles containing HTML tags such as <script>, <img onerror=, <svg onload= within SpiderFoot scan/correlation data.

Remediation Steps

1. 1

   Upgrade SpiderFoot

   Apply the vendor patch or upgrade to the latest SpiderFoot release that HTML-escapes correlation titles and other data derived from external scan sources before rendering.

2. 2

   Sanitize Output Rendering

   If patching is delayed, apply a Content Security Policy (CSP) restricting inline script execution in the SpiderFoot web UI and enforce output encoding on any custom dashboards consuming SpiderFoot data.

3. 3

   Rotate Exposed Credentials

   Rotate all API keys and tokens stored within or accessible to the SpiderFoot instance, especially those used by connected third-party intelligence feeds or automation/agent integrations.

4. 4

   Restrict Scan Target Trust

   Avoid running correlation views against untrusted or adversary-controlled targets until patched; treat scan results as untrusted input requiring sanitization before display or downstream processing.

5. 5

   Isolate Operator Sessions

   Run SpiderFoot web UI in a sandboxed browser profile or isolated VM separate from sessions holding sensitive credentials, reducing blast radius if XSS is triggered.