CVE-2026-28355

"PWA" Canarytoken Vulnerable to Stored Self Cross-Site Scripting

Published Feb 27, 2026 CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed

Description

Canarytokens help track activity and actions on a network. Versions prior to `sha-7ff0e12` have a Self Cross-Site Scripting vulnerability in the "PWA" Canarytoken, whereby the Canarytoken's creator can attack themselves or someone they share the link with. The creator of a PWA Canarytoken can insert Javascript into the title field of their PWA token. When the creator later browses the installation page for their own Canarytoken, the Javascript executes. This is a self-XSS. An attacker could create a Canarytoken with this self-XSS, and send the install link to a victim. When they click on it, the Javascript would execute. However, no sensitive information (ex. session information) will be disclosed to the malicious actor. This issue is now patched on Canarytokens.org. Users of self-hosted Canarytokens installations can update by pulling the latest Docker image, or any Docker image after sha-7ff0e12.

Analysis

Technical impact

Canarytokens include a self‑persistent web app (PWA) token that stores the title text in a database. Prior to commit sha‑7ff0e12 the title field was not sanitized, so a token creator could embed arbitrary JavaScript. When a user later opens the token’s installation page, the browser executes that JavaScript in that user’s context. Although the payload runs locally in the victim’s browser, the supplied description indicates it does not exfiltrate session identifiers or other sensitive data, so the impact is limited to arbitrary script execution without credential theft.

Affected Systems

The issue affects the thinkst:canarytokens product, specifically the PWA token type, in all releases before commit sha‑7ff0e12. Self‑hosted deployments that use older Docker images are also vulnerable.

Risk and Exploitability

The CVSS score is 1.3 and the EPSS probability is below 1 %. The vulnerability is not listed in the KEV catalog. Attackers would need to craft a token with malicious title content, share the installation link and convince a victim to click it. Because the payload runs only in the victim’s browser session and does not compromise server credentials, the overall exploitation likelihood remains low and the scope is limited to the victim’s local environment.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

thinkst

canarytokens

affected

Version	Status	Constraints
`< sha-7ff0e12`	affected	—

No data.

Vendor Product Versions

Thinkst

Canarytokens

Version	Status	Scheme	Platform
`[0,<sha-7ff0e12)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Deploy the patched Docker image with SHA‑7ff0e12 or any newer image.
If running a self‑hosted Canarytokens instance, pull the latest image and redeploy the container.
Review and delete any existing PWA tokens whose titles contain injected JavaScript.
Configure or enforce title field sanitization to prevent future script injections.

Generated by OpenCVE AI on April 16, 2026 at 15:14 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.409% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/thinkst/canarytokens/security/advisories/GHSA-6734-fqcj-x5h3

History

Mar 3, 2026 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 2, 2026 12:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Thinkst Thinkst canarytokens
Vendors & Products		Thinkst Thinkst canarytokens

Feb 27, 2026 9:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Canarytokens help track activity and actions on a network. Versions prior to `sha-7ff0e12` have a Self Cross-Site Scripting vulnerability in the "PWA" Canarytoken, whereby the Canarytoken's creator can attack themselves or someone they share the link with. The creator of a PWA Canarytoken can insert Javascript into the title field of their PWA token. When the creator later browses the installation page for their own Canarytoken, the Javascript executes. This is a self-XSS. An attacker could create a Canarytoken with this self-XSS, and send the install link to a victim. When they click on it, the Javascript would execute. However, no sensitive information (ex. session information) will be disclosed to the malicious actor. This issue is now patched on Canarytokens.org. Users of self-hosted Canarytokens installations can update by pulling the latest Docker image, or any Docker image after sha-7ff0e12.
Title		"PWA" Canarytoken Vulnerable to Stored Self Cross-Site Scripting
Weaknesses		CWE-79
References		https://github.com/thinkst/canarytokens/security/advisories/GHSA-6734-fqcj-x5h3
Metrics		cvssV4_0 `{'score': 1.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U'}`