The vulnerability is a stored cross‑site scripting flaw in the exposed AWS API key store of Thinkst Applied Research Canarytokens. When an attacker delivers a malicious payload that is persisted in the key store, subsequent retrieval of that key by a user causes the payload to execute in the victim’s browser. This can lead to cookie theft, session hijacking or arbitrary script execution within the context of the web application.

Thinkst Applied Research Canarytokens is affected. Docker images tagged before sha-f5aa5c4e and Git commits before f5aa5c4e contain the flaw; all earlier releases up to the referenced identifiers are vulnerable.

The CVSS base score of 1.1 marks the vulnerability as low severity, and no EPSS data is available. It is not listed in CISA KEV, indicating no known public exploitation. The likely attack vector is an anonymous scenario, requiring knowledge of a random identifier used within the key store; based on the description it appears that the exploit is not publicly demonstrated but could be feasible if an attacker has access to a valid identifier.