CVE-2026-10729 — HTML injection in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens

CVE-2026-10729

HTML injection in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens PUBLISHED

Description (CNA)

An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails. This issue affects Canarytokens: from Docker tag sha-c42435e before sha-bfda4df, from Git commit c42435e before bfda4df.

Affected (CNA)

Vendor / product	Versions
Thinkst Applied Research / Canarytokens	affected sha-c42435e before sha-bfda4df; affected c42435e before bfda4df

CWE

CWE-74

References

https://github.com/thinkst/canarytokens/security/advisories/GHSA-hmjv-pj8j-8fg7

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.