CVE-2026-13140: Stored Cross-Site Scripting in Canarytokens.org

Severity: low (CVSS 1.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-24 · updated 2026-10-25
Weakness: CWE-79

Description

Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens. Anonymous exploitation requires knowledge of a random identifier. This issue affects Canarytokens: from Docker tag sha-4116b92cb before sha-f5aa5c4e, from Git commit 4116b92cb before f5aa5c4e.

Affected products

Thinkst Applied Research Canarytokens: from sha-4116b92cb before f5aa5c4e — fixed in f5aa5c4e

How to fix

Upgrade to a fixed version: Thinkst Applied Research Canarytokens f5aa5c4e. Check the vendor advisory for mitigations.

References

https://github.com/thinkst/canarytokens/security/advisories/GHSA-23pf-xjp2-48q6

Get alerted when CVE-2026-13140 or the next vulnerability affects your stack