PT-2026-45936 · Thinkst Applied Research · Canarytokens

Gaurav Popalghat · Published 2026-06-03 · Updated 2026-06-03 · CVE-2026-10729

Positive Technologies (AI Summary)

CVSS v4.0

1.2

Low

Base vector

AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/AU:N/RE:L/U:Green

Name of the Vulnerable Software and Affected Versions Thinkst Applied Research Canarytokens versions sha-c42435e through sha-bfda4df Thinkst Applied Research Canarytokens versions c42435e through bfda4df

Description An HTML injection issue exists in the notification emails for "Slow Redirect" and "Cloned Website" Canarytokens. This allows for Interface Manipulation and Cross-Site Scripting (XSS), which is a technique where malicious scripts are injected into trusted websites or emails, in email clients that render HTML emails.

Recommendations Update Thinkst Applied Research Canarytokens to Docker tag sha-bfda4df or later. Update Thinkst Applied Research Canarytokens to Git commit bfda4df or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2026-10729

Affected Products

Canarytokens

References · 3

• https://github.com/thinkst/canarytokens/security/advisories/GHSA-hmjv-pj8j-8fg7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-10729 · Security Note
• https://t.me/CVEtracker/55716 · Telegram Post