CVE-2026-45087

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45087", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-08T19:27:26.697Z", "datePublished": "2026-05-27T17:34:29.118Z", "dateUpdated": "2026-05-28T13:58:37.247Z"}, "containers": {"cna": {"title": "Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode", "problemTypes": [{"descriptions": [{"cweId": "CWE-15", "lang": "en", "description": "CWE-15: External Control of System or Configuration Setting", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/hahwul/dalfox/security/advisories/GHSA-v25v-m36w-jp4h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-v25v-m36w-jp4h"}, {"name": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0"}], "affected": [{"vendor": "hahwul", "product": "dalfox", "versions": [{"version": "< 2.13.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T17:34:29.118Z"}, "descriptions": [{"lang": "en", "value": "Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options \u2014 including FoundAction and FoundActionShell \u2014 is deserialized directly from attacker-supplied JSON in POST /scan, and because dalfox.Initialize explicitly propagates those two fields into the final scan options without stripping them, any unauthenticated caller who can reach the server port can supply an arbitrary shell command that the dalfox process will execute on the host whenever a scan finding is triggered. This vulnerability is fixed in 2.13.0."}], "source": {"advisory": "GHSA-v25v-m36w-jp4h", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-v25v-m36w-jp4h", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-28T13:58:33.508608Z", "id": "CVE-2026-45087", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T13:58:37.247Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45087", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-28T13:58:33.508608Z"}}}], "references": [{"url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-v25v-m36w-jp4h", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T13:58:21.063Z"}}], "cna": {"title": "Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode", "source": {"advisory": "GHSA-v25v-m36w-jp4h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "hahwul", "product": "dalfox", "versions": [{"status": "affected", "version": "< 2.13.0"}]}], "references": [{"url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-v25v-m36w-jp4h", "name": "https://github.com/hahwul/dalfox/security/advisories/GHSA-v25v-m36w-jp4h", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0", "name": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options \u2014 including FoundAction and FoundActionShell \u2014 is deserialized directly from attacker-supplied JSON in POST /scan, and because dalfox.Initialize explicitly propagates those two fields into the final scan options without stripping them, any unauthenticated caller who can reach the server port can supply an arbitrary shell command that the dalfox process will execute on the host whenever a scan finding is triggered. This vulnerability is fixed in 2.13.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-15", "description": "CWE-15: External Control of System or Configuration Setting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T17:34:29.118Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45087", "state": "PUBLISHED", "dateUpdated": "2026-05-28T13:58:37.247Z", "dateReserved": "2026-05-08T19:27:26.697Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-27T17:34:29.118Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dalfox", "vendor": "hahwul", "versions": [{"status": "affected", "version": "< 2.13.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options \u2014 including FoundAction and FoundActionShell \u2014 is deserialized directly from attacker-supplied JSON in POST /scan, and because dalfox.Initialize explicitly propagates those two fields into the final scan options without stripping them, any unauthenticated caller who can reach the server port can supply an arbitrary shell command that the dalfox process will execute on the host whenever a scan finding is triggered. This vulnerability is fixed in 2.13.0."}, {"lang": "es", "value": "Dalfox es un potente esc\u00e1ner XSS de c\u00f3digo abierto y una utilidad centrada en la automatizaci\u00f3n. Antes de la versi\u00f3n 2.13.0, cuando dalfox se inicia en modo de servidor REST API (dalfox server), el servidor se enlaza a 0.0.0.0:6664 por defecto y no requiere ninguna clave API a menos que el operador pase expl\u00edcitamente --api-key. Debido a que model.Options - incluyendo FoundAction y FoundActionShell - se deserializa directamente del JSON proporcionado por el atacante en POST /scan, y debido a que dalfox.Initialize propaga expl\u00edcitamente esos dos campos en las opciones de escaneo finales sin eliminarlos, cualquier llamador no autenticado que pueda alcanzar el puerto del servidor puede proporcionar un comando de shell arbitrario que el proceso dalfox ejecutar\u00e1 en el host cada vez que se active un hallazgo de escaneo. Esta vulnerabilidad se corrige en la versi\u00f3n 2.13.0."}], "id": "CVE-2026-45087", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45087", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-28T13:58:33.508608Z", "version": "2.0.3"}}]}, "published": "2026-05-27T18:16:24.567", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-v25v-m36w-jp4h"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-v25v-m36w-jp4h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-15"}, {"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.13.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "dalfox", "source": "cna", "vendor": "hahwul"}, "product": "dalfox", "vendor": "hahwul"}], "created": "2026-05-27T19:15:26.081117+00:00", "updated": "2026-10-25T18:45:07.054193+00:00", "vendors": ["hahwul", "hahwul$PRODUCT$dalfox"]}