Vulnerability in Thinkst Applied Research Canarytokens
CVE-2026-10729
An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails. This issue affects Canarytokens: from Docker tag sha-c42435e before sha-bfda4df, from Git commit c42435e before bfda4df.
EPSS: 0.002 (10.4th percentile) — read the EPSS interpretation.
Affected products
- Thinkst Applied Research Canarytokens — versions sha-c42435e, c42435e
Weakness classification (CWE)
References
- 0f2be0ad-3469-4e56-b38f-4eb96719b425 (vendor-advisory)