Vulnerability · Published May 27, 2026 · Assigned by GitHub_M
CVE-2026-45087Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode
Critical 10.0
In plain English
A critical-severity OS command injection in dalfox from hahwul. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 8.7% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Fixed versions are available - upgrade the affected package.
Official description
Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options — including FoundAction and FoundActionShell — is deserialized directly from attacker-supplied JSON in POST /scan, and because dalfox.Initialize explicitly propagates those two fields into the final scan options without stripping them, any unauthenticated caller who can reach the server port can supply an arbitrary shell command that the dalfox process will execute on the host whenever a scan finding is triggered. This vulnerability is fixed in 2.13.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/hahwul/dalfox | no fix listed | GO-2026-5649 |
| Go | github.com/hahwul/dalfox/v2 | 2.13.0 | GHSA-v25v-m36w-jp4h |
| Go | github.com/hahwul/dalfox/v2 | 2.13.0 | GO-2026-5649 |
Affected products (as reported)
Weakness: CWE-15, CWE-78, CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/hahwul/dalfox/security/advisories/GHSA-v25v-m36w-jp4h x_refsource_CONFIRM
- https://github.com/hahwul/dalfox/releases/tag/v2.13.0 x_refsource_MISC