XSS Vulnerability in Dalfox Open-Source Scanner Affects Multiple Versions

CVE-2026-45088

What is CVE-2026-45088?

Dalfox, a widely used open-source XSS scanner, is affected by a vulnerability that allows an unauthenticated network attacker to exfiltrate sensitive information. When operating in REST API server mode prior to version 2.13.0, the tool directly deserializes input from an attacker’s request, enabling them to read arbitrary files on the host system. This occurs as payloads constructed by the attacker can be embedded in outbound HTTP requests, facilitating the extraction of data line-by-line. The vulnerability was addressed in version 2.13.0, underscoring the importance of keeping software updated to mitigate potential risks.

References