CVE-2026-12888: HTML injection in the Canarytoken Google Chat notification

Severity: low (CVSS 2.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-22 · updated 2026-10-25
Weakness: CWE-74

Description

An HTML injection vulnerability exists in the Google Chat webhook notification sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links. This issue affects Canarytokens: from Docker tag sha-4aef1db90 before sha-8ab4dccd, from Git commit 4aef1db90 before 8ab4dccd.

Affected products

Thinkst Applied Research Canarytokens: from sha-4aef1db90 before sha-8ab4dccd — fixed in sha-8ab4dccd

How to fix

Upgrade to a fixed version: Thinkst Applied Research Canarytokens sha-8ab4dccd. Check the vendor advisory for mitigations.

References

https://github.com/thinkst/canarytokens/security/advisories/GHSA-vcfc-7466-8q65

Get alerted when CVE-2026-12888 or the next vulnerability affects your stack