CVE-2026-75626 is a critical cross-site scripting vulnerability in SpiderFoot (smicallef) affecting versions up to 4.0. The issue arises because correlation titles generated from external data sources such as server banners and metadata are not properly HTML-escaped. This flaw enables attackers to inject malicious HTML elements containing event handlers into the correlation results view. When an operator opens this view, the injected scripts execute in their browser context, which can lead to theft of sensitive information like API keys.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the operator's browser session when viewing correlation results. This can result in the theft of API keys and potentially other sensitive data accessible in the browser session. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with high impact on confidentiality, integrity, and availability.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when viewing correlation results from untrusted external data sources and consider restricting access or sanitizing inputs manually if possible.