CVE-2026-11859— HTML injection in the Canarytoken links email
Quick assessment
Affected
Thinkst Applied Research Canarytokens
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Canarytokens是Thinkst Applied Research开源的一个网络活动跟踪系统。 Canarytokens存在注入漏洞，该漏洞源于fetch links邮件中存在HTML注入，可能导致支持HTML渲染的邮件客户端中发生界面操纵和跨站脚本攻击。
Possible ATT&CK Techniques 3 AI
T1556 · Modify Authentication Process T1059 · Command and Scripting Interpreter T1189 · Drive-by CompromiseAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Thinkst Applied Research | Canarytokens | sha-c0f3cf142< sha-08c3f93d |
affected |
c0f3cf142< 08c3f93d |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-11859
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HTML injection in the Canarytoken links email
Source: CVE Program / CVE List V5
Vulnerability Description
An HTML injection vulnerability in the "fetch links" email sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails.
This issue affects Canarytokens: from Docker tag sha-c0f3cf142 before sha-08c3f93d, from Git commit c0f3cf142 before 08c3f93d.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/AU:N/RE:L/U:Green
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Canarytokens 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Canarytokens是Thinkst Applied Research开源的一个网络活动跟踪系统。 Canarytokens存在注入漏洞，该漏洞源于fetch links邮件中存在HTML注入，可能导致支持HTML渲染的邮件客户端中发生界面操纵和跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Thinkst Applied Research | Canarytokens | sha-c0f3cf142 ~ sha-08c3f93d | - |
|
II. Public POCs for CVE-2026-11859
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-11859
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-11859 (1)
IV. Related Vulnerabilities
Same product: Canarytokens
-
CVE-2026-13140
Stored Cross-Site Scripting in Canarytokens.org -
CVE-2026-12888
HTML injection in the Canarytoken Google Chat notification -
CVE-2026-10729
HTML injection in the notification email for "Slow Redirect" -
CVE-2026-28355
"PWA" Canarytoken Vulnerable to Stored Self Cross-Site Scrip -
CVE-2024-41664
Blind SSRF via Canarytoken Webhook
Same vendor: Thinkst Applied Research
-
CVE-2026-85219
Denial-of-Service in the OpenCanary Redis service -
CVE-2026-85220
Denial-of-Service in the Thinkst Canary Redis service -
CVE-2026-16551
Denial-of-Service in OpenCanary's MongoDB module -
CVE-2026-13140
Stored Cross-Site Scripting in Canarytokens.org -
CVE-2026-12888
HTML injection in the Canarytoken Google Chat notification
Same weakness: CWE-74
-
CVE-2026-76472
Cisco Meraki Security Hardening Release October 2026 - Impro -
CVE-2026-102156
Security Advisory 0191 -
CVE-2026-102158
Security Advisory 0190 -
CVE-2026-105800
i18next-http-backend incomplete URL validation permits SSRF -
CVE-2026-101904
Axios: Header Injection via Inherited headers After Minimal
V. Comments for CVE-2026-11859
No comments yet