CVE-2026-45087

{
  "id": "CVE-2026-45087",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T18:16:24.567",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options — including FoundAction and FoundActionShell — is deserialized directly from attacker-supplied JSON in POST /scan, and because dalfox.Initialize explicitly propagates those two fields into the final scan options without stripping them, any unauthenticated caller who can reach the server port can supply an arbitrary shell command that the dalfox process will execute on the host whenever a scan finding is triggered. This vulnerability is fixed in 2.13.0."
    },
    {
      "lang": "es",
      "value": "Dalfox es un potente escáner XSS de código abierto y una utilidad centrada en la automatización. Antes de la versión 2.13.0, cuando dalfox se inicia en modo de servidor REST API (dalfox server), el servidor se enlaza a 0.0.0.0:6664 por defecto y no requiere ninguna clave API a menos que el operador pase explícitamente --api-key. Debido a que model.Options - incluyendo FoundAction y FoundActionShell - se deserializa directamente del JSON proporcionado por el atacante en POST /scan, y debido a que dalfox.Initialize propaga explícitamente esos dos campos en las opciones de escaneo finales sin eliminarlos, cualquier llamador no autenticado que pueda alcanzar el puerto del servidor puede proporcionar un comando de shell arbitrario que el proceso dalfox ejecutará en el host cada vez que se active un hallazgo de escaneo. Esta vulnerabilidad se corrige en la versión 2.13.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "hahwul",
          "product": "dalfox",
          "versions": [
            {
              "version": "< 2.13.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-28T13:58:33.508608Z",
          "id": "CVE-2026-45087",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-15"
        },
        {
          "lang": "en",
          "value": "CWE-78"
        },
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-v25v-m36w-jp4h",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-v25v-m36w-jp4h",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}