SpiderFoot Vulnerability CVE-2026-75626: Critical Risk of API Key Theft
- Severity
- CRITICAL
- CVSS
- 9.3
- Affected component
- spiderfoot (npm)
- Affected versions
- >= v4.0, <= v4.0 or >= v3.5, <= v3.5 or >= v3.4, <= v3.4 or >= v3.3, <= v3.3 or >= v3.2, <= v3.2 or >= v3.1, <= v3.1 or >= v3.0, <= v3.0 or >= v2.12.0-final, <= v2.12.0-final or >= v2.11.0-final, <= v2.11.0-final or >= v2.10-final, <= v2.10-final or >= v2.9.0-final, <= v2.9.0-final or >= v2.8.0-final, <= v2.8.0-final or >= v2.7.1-final, <= v2.7.1-final or >= v2.6.1-final, <= v2.6.1-final or >= v2.5.1-final, <= v2.5.1-final or >= v2.4.0-final, <= v2.4.0-final or >= v2.3.0-final, <= v2.3.0-final or >= v2.2.0-final, <= v2.2.0-final or >= v2.1.5-final, <= v2.1.5-final or >= v2.1.4-final, <= v2.1.4-final or >= v2.1.3-final, <= v2.1.3-final or >= v2.1.2-final, <= v2.1.2-final or >= v2.1.1-final, <= v2.1.1-final or >= v2.1.0-final, <= v2.1.0-final or >= v2.0.5-final, <= v2.0.5-final or >= v2.0.4-final, <= v2.0.4-final or >= v2.0.3-final, <= v2.0.3-final or >= v2.0.2-final, <= v2.0.2-final or >= 2.0.2-final, <= 2.0.2-final or >= v2.0.1-final, <= v2.0.1-final or >= v2.0.0-final, <= v2.0.0-final or >= v2.0.0, <= v2.0.0
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in SpiderFoot, tracked as CVE-2026-75626, which could allow attackers to steal API keys through malicious HTML injection.
What happened
SpiderFoot reportedly fails to HTML-escape correlation titles built from external scan data sources, including server banners and metadata. This oversight allows attackers to inject malicious HTML elements with event handlers into correlation results. When an operator opens the correlations view, these elements can execute scripts in the operator's browser, potentially leading to the theft of API keys.
The vulnerability affects all versions of SpiderFoot from v2.0.0 to v4.0. No exploitation in the wild has been confirmed, and no official fix has been published yet. Users are advised to monitor primary sources for updates.
What to do about it
- Monitor primary sources for updates on a patch for CVE-2026-75626.
- Review your SpiderFoot correlation results for any signs of tampering or unusual activity.
- Consider implementing additional security measures to protect API keys, such as using environment variables or secret management services.
- No official fix has been published yet. Monitor the sources below for updates on a patch.
How 0Day would have caught this
spiderfoot is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using SpiderFoot version v2.0.0 or later, you are affected by this vulnerability.
What should I do right now?
Monitor primary sources for updates on a patch and review your SpiderFoot correlation results for any signs of tampering.
Is there a patch available?
No official fix has been published yet. Continue to monitor primary sources for updates.