« Volver al listado

CVE-2026-10729

Estado: AplazadaBaja (1.2)—

An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails.

This issue affects Canarytokens: from Docker tag sha-c42435e before sha-bfda4df, from Git commit c42435e before bfda4df.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Thinkst — CanarytokensAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-10729",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-10729",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-03T15:44:44.272580Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "0f2be0ad-3469-4e56-b38f-4eb96719b425",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 1.2,
          "Automatable": "NO",
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Green",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "providerUrgency": "GREEN",
          "userInteraction": "ACTIVE",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "LOW",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "0f2be0ad-3469-4e56-b38f-4eb96719b425",
      "affectedData": [
        {
          "vendor": "Thinkst Applied Research",
          "product": "Canarytokens",
          "versions": [
            {
              "status": "affected",
              "version": "sha-c42435e",
              "lessThan": "sha-bfda4df",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "c42435e",
              "lessThan": "bfda4df",
              "versionType": "git"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-03T14:16:35.533",
  "references": [
    {
      "url": "https://github.com/thinkst/canarytokens/security/advisories/GHSA-hmjv-pj8j-8fg7",
      "source": "0f2be0ad-3469-4e56-b38f-4eb96719b425"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "0f2be0ad-3469-4e56-b38f-4eb96719b425",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An HTML injection vulnerability in the notification email for \"Slow Redirect\" and \"Cloned Website\" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails.\n\n\nThis issue affects Canarytokens: from Docker tag sha-c42435e before sha-bfda4df, from Git commit c42435e before bfda4df."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección HTML en el correo electrónico de notificación para los Canarytokens de 'Redirección Lenta' y 'Sitio Web Clonado' existe en Thinkst Applied Research Canarytokens, lo que permite la manipulación de la interfaz, cross-site scripting (XSS) en clientes de correo electrónico que renderizan correos HTML.\n\nEste problema afecta a Canarytokens: desde la etiqueta de Docker sha-c42435e anterior a sha-bfda4df, desde el commit de Git c42435e anterior a bfda4df."
    }
  ],
  "lastModified": "2026-07-22T19:10:00.120",
  "sourceIdentifier": "0f2be0ad-3469-4e56-b38f-4eb96719b425"
}