Is CVE-2026-45087 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45087 being exploited in the wild.

How severe is CVE-2026-45087?

Critical severity, with a CVSS score of 10, published 27 May 2026.

Which products and versions are affected?

github.com/hahwul/dalfox (Go) SEMVER:introduced=0; github.com/hahwul/dalfox/v2 (Go) <= 2.12.0, SEMVER:introduced=0,fixed=2.13.0; Hahwul Dalfox <= 2.12.0.

Is there a fix for CVE-2026-45087?

Yes. github.com/hahwul/dalfox/v2 (Go): upgrade to 2.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45087 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45087?

Check whether you run github.com/hahwul/dalfox (Go), github.com/hahwul/dalfox/v2 (Go) or Hahwul Dalfox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45087: hahwul Dalfox unauthenticated RCE in REST API server mode

Q: Is there a fix for CVE-2026-45087?

Yes. github.com/hahwul/dalfox/v2 (Go): upgrade to 2.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45087 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45087?

Check whether you run github.com/hahwul/dalfox (Go), github.com/hahwul/dalfox/v2 (Go) or Hahwul Dalfox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45087 · Severity: critical · CVSS 10 · Published 2026-05-27

Dalfox, a tool used for scanning web applications for vulnerabilities, contains a flaw in its server mode that allows unauthenticated attackers to execute arbitrary commands on the host system. By default, the server does not require an API key and allows users to specify shell commands that run automatically when a vulnerability is found. An attacker can exploit this by sending a malicious scan request, leading to full control over the server, data theft, or service disruption.

Technologies: github.com/hahwul/dalfox (Go), github.com/hahwul/dalfox/v2 (Go), Hahwul Dalfox. Vendors: Go, Hahwul.

Quick answers

Is CVE-2026-45087 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45087 being exploited in the wild.
How severe is CVE-2026-45087?: Critical severity, with a CVSS score of 10, published 27 May 2026.
Which products and versions are affected?: github.com/hahwul/dalfox (Go) SEMVER:introduced=0; github.com/hahwul/dalfox/v2 (Go) <= 2.12.0, SEMVER:introduced=0,fixed=2.13.0; Hahwul Dalfox <= 2.12.0.
Is there a fix for CVE-2026-45087?: Yes. github.com/hahwul/dalfox/v2 (Go): upgrade to 2.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45087 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45087?: Check whether you run github.com/hahwul/dalfox (Go), github.com/hahwul/dalfox/v2 (Go) or Hahwul Dalfox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/hahwul/dalfox/v2 (Go): upgrade to 2.13.0 or later
```
go get github.com/hahwul/dalfox/v2@v2.13.0
```

Technical details

Dalfox's REST API server mode (cmd/server.go) defaults to binding on 0.0.0.0 and does not enforce authentication unless an API key is explicitly configured. The 'POST /scan' endpoint deserializes the 'model.Options' struct directly from user-supplied JSON, which includes 'FoundAction' and 'FoundActionShell' fields. These fields are propagated without sanitization to the scanning engine. When a scan finding is triggered—which an attacker can guarantee by pointing the scan at a controlled reflective target—the 'foundAction' function in 'pkg/scanning/foundaction.go' executes the attacker-provided shell command using 'exec.Command'. This allows for full OS-level command execution with the privileges of the Dalfox process.

Affected products

hahwul dalfox <= 2.12.0

Identifiers

CVE-2026-45087
GHSA-v25v-m36w-jp4h
GO-2026-5649

Timeline

2026-05-07: disclosed: Initial disclosure on GitHub
2026-05-12: advisory: Published GHSA advisory
2026-05-12: patched: Fixed in version 2.13.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.