Read the docs
TI-2026-32934 Aliases CVE-2026-45087GHSA-v25v-m36w-jp4h

Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode

Priority HIGH 82CWE-15Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306 and CWE-78.

Summary

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options — including FoundAction and FoundActionShell — is deserialized directly from attacker-supplied JSON in POST /scan, and because dalfox.Initialize explicitly propagates those two fields into the final scan options without stripping them, any unauthenticated caller who can reach the server port can supply an arbitrary shell command that the dalfox process will execute on the host whenever a scan finding is triggered. This vulnerability is fixed in 2.13.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.08731 95th percentileScored 2026-11-07
Fix Fixed dalfox (hahwul): 2.13.0github.com/hahwul/dalfox/v2 (Go): 2.13.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hahwuldalfoxbefore 2.13.02.13.0Patch availableCNA
—github.com/hahwul/dalfox/v2 (Go)before 2.13.02.13.0Patch availableGHSA-v25v-m36w-jp4h
  • dalfox Vendorhahwul Affected before 2.13.0 Fixed in 2.13.0 Patch available CNA
  • github.com/hahwul/dalfox/v2 (Go) Vendor— Affected before 2.13.0 Fixed in 2.13.0 Patch available GHSA-v25v-m36w-jp4h

Remediation

  • Fix · CNA dalfox (hahwul) Fixed in 2.13.0
  • Fix · GHSA-v25v-m36w-jp4h github.com/hahwul/dalfox/v2 (Go) Fixed in 2.13.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45087
  2. 2026-10-03 Alias added: GHSA-v25v-m36w-jp4h
  3. 2026-10-25 EPSS moved to the 95th–99th percentile

References

Advisory 1

Other 3

  • TI-2026-32936 Dalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Mode CVSS 3.1HIGH 8.2
  • TI-2026-32937 Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode) CVSS 3.1HIGH 7.5
  • TI-2026-32935 Missing authentication in hahwul dalfox CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences