📄 Dalfox Found-Action Deserialization Remote Code Execution

When dalfox versions less than or equal to 2.12.0 is started in REST API server mode dalfox server, the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options - including FoundAction and FoundActionShell - is...

CVE-2026-45087

Dalfox (server mode) prior to v2.13.0 is vulnerable to unauthenticated remote code execution. When running dalfox server with default 0.0.0.0:6664 and no API key, POST /scan deserializes attacker-controlled options (FoundAction and FoundActionShell) into scan config, then shell commands are execu...

Dalfox Found-Action Deserialization RCE

When dalfox version use exploit/linux/http/dalfox/serverrcecve202645087 msf undefinedserverrcecve202645087 show actions ...actions... msf undefinedserverrcecve202645087 set ACTION msf undefinedserverrcecve202645087 show options ...show and set options... msf undefinedserverrcecve202645087 run Thi...