PT-2026-51301 · Google+1 · Google Chat+1

Github.Com/Geo-Chen · Published 2026-06-22 · Updated 2026-06-22 · CVE-2026-12888

Positive Technologies (AI Summary)

CVSS v4.0

2.0

Low

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/AU:N/RE:L/U:Green

Name of the Vulnerable Software and Affected Versions Canarytokens versions sha-4aef1db90 through sha-8ab4dccd

Description An HTML injection issue exists in the Google Chat webhook notification sent by Thinkst Applied Research Canarytokens. This allows for interface manipulation in Google Chat by inserting limited HTML content, including links.

Recommendations Update Canarytokens to version sha-8ab4dccd or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2026-12888

Affected Products

Canarytokens

Google Chat

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-12888 · Security Note
• https://github.com/thinkst/canarytokens/security/advisories/GHSA-vcfc-7466-8q65 · Note
• https://twitter.com/CVEnew/status/2069090877453332676 · Twitter Post