CVE-2026-12888

Severity CVSS v4.0:

LOW

Type:

CWE-74 Injection

Publication date:

22/06/2026

Last modified:

23/06/2026

Description

An HTML injection vulnerability exists in the Google Chat webhook notification sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links.<br /> <br /> <br /> This issue affects Canarytokens: from Docker tag sha-4aef1db90 before sha-8ab4dccd, from Git commit 4aef1db90 before 8ab4dccd.

Impact

Vector 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/AU:N/RE:L/U:Green CVSS v4.0 Severity and Metrics:

Base Score: 2.00 LOW
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/AU:N/RE:L/U:Green

Attack Vector (AV): Network
Attack Complexity (AC): Low
Attack Requirements (AT): None
Privileges Required (PR): None
User Interaction (UI): Active
Confidentiality (VC): None
Integrity (VI): None
Availability (VA): None
Confidentiality (SC): None
Integrity (SI): Low
Availability (SA): None
Automatable (AU): No
Vulnerability Response Effort (RE): Low
Provider Urgency (U): Green
Exploit Maturity (E): POC

Base Score 4.0

2.00

Severity 4.0

LOW

References to Advisories, Solutions, and Tools

https://github.com/thinkst/canarytokens/security/advisories/GHSA-vcfc-7466-8q65