Skip to content
CVE PROGRAM SOURCE RECORD2.0 Low

CVE-2026-12888

HTML injection in the Canarytoken Google Chat notification

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ThinkstAppliedResearch

Description

An HTML injection vulnerability exists in the Google Chat webhook notification  sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links. This issue affects Canarytokens: from Docker tag sha-4aef1db90 before sha-8ab4dccd, from Git commit 4aef1db90 before 8ab4dccd.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Thinkst Applied Research Canarytokens

Default version status: unaffected

  • sha-4aef1db90 to < sha-8ab4dccdaffected
  • 4aef1db90 to < 8ab4dccdaffected

References