CVE-2026-12888

LOW EPSS 20.3%

Published Jun 22, 20261w ago · Modified Jun 23, 20261w ago

2.0 CVSS 4.0

Low

Published Jun 22, 2026 1w ago

Last Modified Jun 23, 2026 1w ago

Description

An HTML injection vulnerability exists in the Google Chat webhook notification sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links. This issue affects Canarytokens: from Docker tag sha-4aef1db90 before sha-8ab4dccd, from Git commit 4aef1db90 before 8ab4dccd.

CVSS Details

Base Score

2.0

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Green

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction A

Scope X

Threat Intelligence

EPSS Exploit Probability

20.3% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-74

References 1

github.com https://github.com/thinkst/canarytokens/security/advisories/GHSA-vcfc-7466-8q65

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.