CVE-2026-12888

HTML injection in the Canarytoken Google Chat notification

State: Published
Severity: 2.0 Low
Published: Jun 22, 2026
Updated: Jun 22, 2026
Reserved: Jun 22, 2026

Description

An HTML injection vulnerability exists in the Google Chat webhook notification sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links.

This issue affects Canarytokens: from Docker tag sha-4aef1db90 before sha-8ab4dccd, from Git commit 4aef1db90 before 8ab4dccd.

Scores

CVSS	Score	Vector	Source
4.0	2.0 Low	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/AU:N/RE:L/U:Green	ThinkstAppliedResearch

Weaknesses

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Affected Products

Product	Versions
CanarytokensThinkst Applied Research	sha-4aef1db90 to before sha-8ab4dccdAffected 4aef1db90 to before 8ab4dccdAffected

References

https://github.com/thinkst/canarytokens/security/advisories/GHSA-vcfc-7466-8q65

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.