What’s Vulnerable › Vulnerabilities

CVE-2024-28111: CSV Injection in exported history CSV files

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-06 · updated 2026-06-17
• Weakness: CWE-1236

Description

Canarytokens helps track activity and actions on a network. Canarytokens.org supports exporting the history of a Canarytoken's incidents in CSV format. The generation of these CSV files is vulnerable to a CSV Injection vulnerability. This flaw can be used by an attacker who discovers an HTTP-based Canarytoken to target the Canarytoken's owner, if the owner exports the incident history to CSV and opens in a reader application such as Microsoft Excel. The impact is that this issue could lead to code execution on the machine on which the CSV file is opened. Version sha-c595a1f8 contains a fix for this issue.

Affected products

• thinkst canarytokens: before sha-c595a1f8 — fixed in sha-c595a1f8

How to fix

Upgrade to a fixed version: thinkst canarytokens sha-c595a1f8. Check the vendor advisory for mitigations.

References

• https://github.com/thinkst/canarytokens/commit/c595a1f884b986da2ca05aa5bff9ae5f93c6a4aa
• https://github.com/thinkst/canarytokens/security/advisories/GHSA-fqh6-v4qp-65fv
• https://github.com/thinkst/canarytokens/commit/c595a1f884b986da2ca05aa5bff9ae5f93c6a4aa
• https://github.com/thinkst/canarytokens/security/advisories/GHSA-fqh6-v4qp-65fv

Get alerted when CVE-2024-28111 or the next vulnerability affects your stack