CVE-2026-10729

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-10729

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10729.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-10729

Aliases

GHSA-hmjv-pj8j-8fg7

Published

2026-06-03T13:02:15Z

Modified

2026-10-28T02:31:05Z

Severity

1.2 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/AU:N/RE:L/U:Green CVSS Calculator

Summary

HTML injection in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens

Details

An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails.

This issue affects Canarytokens: from Docker tag sha-c42435e before sha-bfda4df, from Git commit c42435e before bfda4df.

Database specific

{
    "cna_assigner":  "ThinkstAppliedResearch",
    "cwe_ids":  [
        "CWE-74"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10729.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "sha-c42435e"
                        },
                        {
                            "fixed":  "sha-bfda4df"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/thinkst/canarytokens

Affected ranges

Type

GIT

Repo

https://github.com/thinkst/canarytokens

Events

Introduced

c42435e

Fixed

bfda4df

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "c42435e"
                },
                {
                    "fixed":  "bfda4df"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10729.json"