Thinkst Canarytokens HTML Injection/XSS Vulnerability (CVE-2026-11899) Advisory

Vulnerability Overview Vulnerability Name: HTML injection in the Canarytokens links email Vulnerability Description: An HTML injection vulnerability exists in the "fetch links" email sent by Thinkst Applied Research Canarytokens, enabling interface manipulation and cross-site scripting (XSS). This affects mail clients that render HTML emails. Severity: Medium (5.1 / 10) Scope of Impact Affected Package: Canarytokens Affected Version: sha-sha-c03cf142 Fixed Version: sha-08c3933d Impact: Depends on the capabilities of the recipient's mail client. Many clients render embedded HTML within emails but do not filter known malicious HTML elements (such as script tags). In the minimal case, the issue allows the injection of phishing links, additional HTML, and images into notification emails. Remediation Patch: The issue has been fixed on Canarytokens.org. Update Method: Users with self-hosted Canarytokens installations can update by pulling the latest Docker image (or any Docker image after sha-08c3933d). Additional Information CVSS v4 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Privileges Required: None - User Interaction: Active - Vulnerable System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: Low - Availability: None CVE ID: CVE-2026-11899 Weakness: CWE-74 Acknowledgments: Thanks to @arkmarta for the report

Goal Reached Thanks to every supporter — we hit 100%!

Thinkst Canarytokens HTML Injection/XSS Vulnerability (CVE-2026-11899) Advisory

More from this source