An HTML injection flaw exists in the “fetch links” email generated by Thinkst Applied Research Canarytokens. The vulnerability allows a malicious actor to insert arbitrary HTML content into the email sent to end‑users. Any email client that renders the HTML payload can be tricked into executing the injected code, resulting in interface manipulation.

Systems that employ the Canarytokens Docker image with a digest of sha-c0f3cf142 or any earlier digest before sha-08c3f93d, as well as builds from any Git commit prior to 08c3f93d, are affected. The issue is limited to the Docker‑based deployment of Thinkst Applied Research Canarytokens.

The CVSS score of 2 indicates a low‑severity vulnerability. EPSS score of 0.00047 and the weakness is not listed in CISA’s KEV catalog, implying limited exploitation activity. However, the flaw can be exploitable by attackers who can influence the content of the “fetch links” email or target users who open such emails in clients that render HTML.