CVE-2026-11859

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-11859

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11859.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-11859

Aliases

GHSA-55jf-cqr9-r7p4

Published

2026-06-10T11:35:14Z

Modified

2026-10-28T02:30:20Z

Severity

2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/AU:N/RE:L/U:Green CVSS Calculator

Summary

HTML injection in the Canarytoken links email

Details

An HTML injection vulnerability in the "fetch links" email sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails.

This issue affects Canarytokens: from Docker tag sha-c0f3cf142 before sha-08c3f93d, from Git commit c0f3cf142 before 08c3f93d.

Database specific

{
    "cna_assigner":  "ThinkstAppliedResearch",
    "cwe_ids":  [
        "CWE-74"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11859.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "sha-c0f3cf142"
                        },
                        {
                            "fixed":  "sha-08c3f93d"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/thinkst/canarytokens

Affected ranges

Type

GIT

Repo

https://github.com/thinkst/canarytokens

Events

Introduced

c0f3cf142

Fixed

08c3f93d

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "c0f3cf142"
                },
                {
                    "fixed":  "08c3f93d"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11859.json"