HTML injection in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens
Priority LOW 7CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails. This issue affects Canarytokens: from Docker tag sha-c42435e before sha-bfda4df, from Git commit c42435e before bfda4df.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00204 10th percentileScored 2026-11-07
Fix Fixed Canarytokens (Thinkst Applied Research): sha-bfda4df
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Thinkst Applied Research | Canarytokens | sha-c42435e to before sha-bfda4df | sha-bfda4df | Patch available | CNA |
- Canarytokens VendorThinkst Applied Research Affected sha-c42435e to before sha-bfda4df Fixed in sha-bfda4df Patch available CNA
Remediation
- Fix · CNA Canarytokens (Thinkst Applied Research) Fixed in sha-bfda4df
Timeline
- 2026-10-02 Threatist record created from CVE-2026-10729
References
More Thinkst Applied Research vulnerabilities
- TI-2026-13810 Denial-of-Service in OpenCanary's MongoDB module CVSS 4.0MEDIUM 6.9
- TI-2026-58544 Denial-of-Service in the Thinkst Canary Redis service CVSS 3.1LOW 3.7
- TI-2026-58543 Denial-of-Service in the OpenCanary Redis service CVSS 3.1LOW 3.7
- TI-2026-10985 HTML injection in the Canarytoken Google Chat notification CVSS 4.0LOW 2.0
- TI-2026-10234 HTML injection in the Canarytoken links email CVSS 4.0LOW 2.0
- TI-2026-11158 Stored Cross-Site Scripting in Canarytokens.org CVSS 4.0LOW 1.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences