Canarytokens include a self‑persistent web app (PWA) token that stores the title text in a database. Prior to commit sha‑7ff0e12 the title field was not sanitized, so a token creator could embed arbitrary JavaScript. When a user later opens the token’s installation page, the browser executes that JavaScript in that user’s context. Although the payload runs locally in the victim’s browser, the supplied description indicates it does not exfiltrate session identifiers or other sensitive data, so the impact is limited to arbitrary script execution without credential theft.

The issue affects the thinkst:canarytokens product, specifically the PWA token type, in all releases before commit sha‑7ff0e12. Self‑hosted deployments that use older Docker images are also vulnerable.

The CVSS score is 1.3 and the EPSS probability is below 1 %. The vulnerability is not listed in the KEV catalog. Attackers would need to craft a token with malicious title content, share the installation link and convince a victim to click it. Because the payload runs only in the victim’s browser session and does not compromise server credentials, the overall exploitation likelihood remains low and the scope is limited to the victim’s local environment.