CVE-2026-11859

Vulnerability Description

An HTML injection vulnerability in the "fetch links" email sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails. This issue affects Canarytokens: from Docker tag sha-c0f3cf142 before sha-08c3f93d, from Git commit c0f3cf142 before 08c3f93d.

Related Weaknesses (CWE)

CWE-74

References

https://github.com/thinkst/canarytokens/security/advisories/GHSA-55jf-cqr9-r7p4

FAQ

What is CVE-2026-11859?

CVE-2026-11859 is a documented vulnerability. An HTML injection vulnerability in the "fetch links" email sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML...

How severe is CVE-2026-11859?

CVSS scoring is not yet available for CVE-2026-11859. Check NVD for updates.

Is there a patch for CVE-2026-11859?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.