CVE-2026-45087: critical vulnerability in hahwul dalfox
Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
43Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 10epss 8.7%
from disclosure to weaponsame day
Published on NVDMay 27
metasploitMay 7
Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options — including FoundAction and FoundActionShell — is deserialized directly from attacker-supplied JSON in POST /scan, and because dalfox.Initialize explicitly propagates those two fields into the final scan options without stripping them, any unauthenticated caller who can reach the server port can supply an arbitrary shell command that the dalfox process will execute on the host whenever a scan finding is triggered. This vulnerability is fixed in 2.13.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
hahwul · dalfoxRelated CVEs — hahwul dalfox
In the same product, most dangerous first.
CVE-2026-45088HIGHDalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server ModeEPSS 0.3%CVE-2026-45090HIGHDalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)EPSS 0.3%CVE-2026-45089HIGHDalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server ModeEPSS 0.2%