Vulnerability · Published Jun 3, 2026 · Assigned by ThinkstAppliedResearch

CVE-2026-10729HTML injection in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens

Low 1.2

In plain English

A low-severity injection in Canarytokens from Thinkst Applied Research. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 4.0)1.2Low

Exploit odds (30 days)0.2%top 89.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails. This issue affects Canarytokens: from Docker tag sha-c42435e before sha-bfda4df, from Git commit c42435e before bfda4df.

Affected products (as reported)

Vendor	Product	Versions
Thinkst Applied Research	Canarytokens	sha-c42435e – before sha-bfda4dfc42435e – before bfda4df

Weakness: CWE-74 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/AU:N/RE:L/U:Green

References

https://github.com/thinkst/canarytokens/security/advisories/GHSA-hmjv-pj8j-8fg7 vendor-advisory