Vulnerability · Published Jun 10, 2026 · Assigned by ThinkstAppliedResearch

CVE-2026-11859HTML injection in the Canarytoken links email

Low 2.0

In plain English

A low-severity injection in Canarytokens from Thinkst Applied Research. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 4.0)2.0Low

Exploit odds (30 days)0.3%top 82.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An HTML injection vulnerability in the "fetch links" email sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails. This issue affects Canarytokens: from Docker tag sha-c0f3cf142 before sha-08c3f93d, from Git commit c0f3cf142 before 08c3f93d.

Affected products (as reported)

Vendor	Product	Versions
Thinkst Applied Research	Canarytokens	sha-c0f3cf142 – before sha-08c3f93dc0f3cf142 – before 08c3f93d

Weakness: CWE-74 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/AU:N/RE:L/U:Green

References

https://github.com/thinkst/canarytokens/security/advisories/GHSA-55jf-cqr9-r7p4