Skip to content
CVE PROGRAM SOURCE RECORD1.1 Low

CVE-2026-13140

Stored Cross-Site Scripting in Canarytokens.org

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ThinkstAppliedResearch

Description

Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens. Anonymous exploitation requires knowledge of a random identifier. This issue affects Canarytokens: from Docker tag sha-4116b92cb before sha-f5aa5c4e, from Git commit 4116b92cb before f5aa5c4e.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Thinkst Applied Research Canarytokens

Default version status: unaffected

  • sha-4116b92cb to < f5aa5c4eaffected
  • 4116b92cb to < f5aa5c4eaffected

References