CVE-2026-45087 Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode
Unauthenticated attackers can execute arbitrary shell commands on the host by sending malicious JSON to the Dalfox server API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45087?
CVE-2026-45087 is a critical command injection vulnerability in hahwul dalfox, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options — including FoundAction and FoundActionShell — is deserialized directly from attacker-supplied JSON in POST /scan, and because dalfox.Initialize explicitly propagates those two fields into the final scan options without stripping them, any unauthenticated caller who can reach the server port can supply an arbitrary shell command that the dalfox process will execute on the host whenever a scan finding is triggered. This vulnerability is fixed in 2.13.0.
Which versions are affected by CVE-2026-45087?
4 open source packages ship an affected version, including github.com/hahwul/dalfox/v2 and github.com/hahwul/dalfox.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hahwul/dalfox/v2 Go | All versions | 2.13.0 |
github.com/hahwul/dalfox/v2 Go | All versions | 2.13.0 |
github.com/hahwul/dalfox/v2 Go | All versions | 2.13.0 |
github.com/hahwul/dalfox Go | All versions | None |
How do I fix CVE-2026-45087?
Upgrade github.com/hahwul/dalfox/v2 to 2.13.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-45087 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45087 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-v25v-m36w-jp4h, GO-2026-5649.