CVEvulnerability

CVE-2026-12888

2.0 LOW Published 2026-06-22 Modified 2026-10-25 Official page ↗
Status
Awaiting Analysis
Published
2026-06-22
Last modified
2026-10-25
Assigner
0f2be0ad-3469-4e56-b38f-4eb96719b425
CVSS 4.0 (0f2be0ad-3469-4e56-b38f-4eb96719b425)
2.0 LOW — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Green
Weaknesses
CWE-74

Description

An HTML injection vulnerability exists in the Google Chat webhook notification  sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links. This issue affects Canarytokens: from Docker tag sha-4aef1db90 before sha-8ab4dccd, from Git commit 4aef1db90 before 8ab4dccd.

Related

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References