Threat Investigation
Request a demo

CVE-2026-12888

Low

Description

An HTML injection vulnerability exists in the Google Chat webhook notification  sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links. This issue affects Canarytokens: from Docker tag sha-4aef1db90 before sha-8ab4dccd, from Git commit 4aef1db90 before 8ab4dccd.

SeverityLow
CVSS2.0
Exploit probability—
ProductCanarytokens
PublishedJun 22, 2026
First seenJun 22, 2026
Weakness typeCWE-74Injection

How to fix

Update
  • Thinkst Applied Research Canarytokenssha-8ab4dccd, 8ab4dccd or later

Affected products

ProductAffected versionsFixed in
Thinkst Applied Research Canarytokenssha-4aef1db90 ≤ v < sha-8ab4dccd, 4aef1db90 ≤ v < 8ab4dccdsha-8ab4dccd, 8ab4dccd

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.