CVE-2026-45087 Details
Description
Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options — including FoundAction and FoundActionShell — is deserialized directly from attacker-supplied JSON in POST /scan, and because dalfox.Initialize explicitly propagates those two fields into the final scan options without stripping them, any unauthenticated caller who can reach the server port can supply an arbitrary shell command that the dalfox process will execute on the host whenever a scan finding is triggered. This vulnerability is fixed in 2.13.0.
A critical remote code execution vulnerability has been identified in Dalfox versions prior to 2.13.0. When Dalfox is run in REST API server mode, it binds to all network interfaces on port 6664 by default and does not require an API key unless explicitly specified. The vulnerability arises because the server deserializes user-supplied JSON into the options model, including execution control fields, which are then passed to the scanning process without proper sanitization. This allows any unauthenticated user who can access the server port to execute arbitrary shell commands on the host whenever a scan finding is detected.
Upgrade to Dalfox version 2.13.0 or later, and ensure that the API key is required when running the server in REST mode.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hahwul/dalfox/security/advisories/GHSA-v25v-m36w-jp4h | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/hahwul/dalfox/releases/tag/v2.13.0 | [email protected] | Release NotesVendor |
| https://github.com/hahwul/dalfox/security/advisories/GHSA-v25v-m36w-jp4h | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-15 | External Control of System or Configuration Setting | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dalfox | <= 2.12.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |