CVE-2026-10729
LowCVSS 1.2Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
An HTML injection vulnerability was found in Canarytokens notification emails for 'Slow Redirect' and 'Cloned Website'. It allows interface manipulation and XSS in email clients that render HTML.
Risk Assessment
An attacker can craft a token that, when triggered, displays malicious HTML/JavaScript in the victim's email, potentially leading to data theft or account takeover.
Recommendation
Update Canarytokens to a patched version (sha-bfda4df or later) and consider disabling HTML rendering in email clients.
Original NVD description (English source)
An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails. This issue affects Canarytokens: from Docker tag sha-c42435e before sha-bfda4df, from Git commit c42435e before bfda4df.