CVE-2026-13140 — Stored Cross-Site Scripting in Canarytokens.org

CVE-2026-13140

Stored Cross-Site Scripting in Canarytokens.org PUBLISHED

Description (CNA)

Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens. Anonymous exploitation requires knowledge of a random identifier. This issue affects Canarytokens: from Docker tag sha-4116b92cb before sha-f5aa5c4e, from Git commit 4116b92cb before f5aa5c4e.

Affected (CNA)

Vendor / product	Versions
Thinkst Applied Research / Canarytokens	affected sha-4116b92cb before f5aa5c4e; affected 4116b92cb before f5aa5c4e

CWE

CWE-79

References

https://github.com/thinkst/canarytokens/security/advisories/GHSA-23pf-xjp2-48q6

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.