CVE-2026-28355

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28355", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-26T18:38:13.890Z", "datePublished": "2026-02-27T21:04:13.445Z", "dateUpdated": "2026-03-03T20:29:43.254Z"}, "containers": {"cna": {"title": "\"PWA\" Canarytoken Vulnerable to Stored Self Cross-Site Scripting", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 1.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/thinkst/canarytokens/security/advisories/GHSA-6734-fqcj-x5h3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/thinkst/canarytokens/security/advisories/GHSA-6734-fqcj-x5h3"}], "affected": [{"vendor": "thinkst", "product": "canarytokens", "versions": [{"version": "< sha-7ff0e12", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T21:04:13.445Z"}, "descriptions": [{"lang": "en", "value": "Canarytokens help track activity and actions on a network. Versions prior to `sha-7ff0e12` have a Self Cross-Site Scripting vulnerability in the \"PWA\" Canarytoken, whereby the Canarytoken's creator can attack themselves or someone they share the link with. The creator of a PWA Canarytoken can insert Javascript into the title field of their PWA token. When the creator later browses the installation page for their own Canarytoken, the Javascript executes. This is a self-XSS. An attacker could create a Canarytoken with this self-XSS, and send the install link to a victim. When they click on it, the Javascript would execute. However, no sensitive information (ex. session information) will be disclosed to the malicious actor. This issue is now patched on Canarytokens.org. Users of self-hosted Canarytokens installations can update by pulling the latest Docker image, or any Docker image after sha-7ff0e12."}], "source": {"advisory": "GHSA-6734-fqcj-x5h3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T20:29:36.968008Z", "id": "CVE-2026-28355", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T20:29:43.254Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28355", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-03T20:29:36.968008Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T20:29:40.550Z"}}], "cna": {"title": "\"PWA\" Canarytoken Vulnerable to Stored Self Cross-Site Scripting", "source": {"advisory": "GHSA-6734-fqcj-x5h3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 1.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "thinkst", "product": "canarytokens", "versions": [{"status": "affected", "version": "< sha-7ff0e12"}]}], "references": [{"url": "https://github.com/thinkst/canarytokens/security/advisories/GHSA-6734-fqcj-x5h3", "name": "https://github.com/thinkst/canarytokens/security/advisories/GHSA-6734-fqcj-x5h3", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Canarytokens help track activity and actions on a network. Versions prior to `sha-7ff0e12` have a Self Cross-Site Scripting vulnerability in the \"PWA\" Canarytoken, whereby the Canarytoken's creator can attack themselves or someone they share the link with. The creator of a PWA Canarytoken can insert Javascript into the title field of their PWA token. When the creator later browses the installation page for their own Canarytoken, the Javascript executes. This is a self-XSS. An attacker could create a Canarytoken with this self-XSS, and send the install link to a victim. When they click on it, the Javascript would execute. However, no sensitive information (ex. session information) will be disclosed to the malicious actor. This issue is now patched on Canarytokens.org. Users of self-hosted Canarytokens installations can update by pulling the latest Docker image, or any Docker image after sha-7ff0e12."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T21:04:13.445Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28355", "state": "PUBLISHED", "dateUpdated": "2026-03-03T20:29:43.254Z", "dateReserved": "2026-02-26T18:38:13.890Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-27T21:04:13.445Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "canarytokens", "vendor": "thinkst", "versions": [{"status": "affected", "version": "< sha-7ff0e12"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Canarytokens help track activity and actions on a network. Versions prior to `sha-7ff0e12` have a Self Cross-Site Scripting vulnerability in the \"PWA\" Canarytoken, whereby the Canarytoken's creator can attack themselves or someone they share the link with. The creator of a PWA Canarytoken can insert Javascript into the title field of their PWA token. When the creator later browses the installation page for their own Canarytoken, the Javascript executes. This is a self-XSS. An attacker could create a Canarytoken with this self-XSS, and send the install link to a victim. When they click on it, the Javascript would execute. However, no sensitive information (ex. session information) will be disclosed to the malicious actor. This issue is now patched on Canarytokens.org. Users of self-hosted Canarytokens installations can update by pulling the latest Docker image, or any Docker image after sha-7ff0e12."}, {"lang": "es", "value": "Canarytokens ayudan a rastrear la actividad y las acciones en una red. Las versiones anteriores a 'sha-7ff0e12' tienen una vulnerabilidad de Self Cross-Site Scripting en el Canarytoken 'PWA', mediante la cual el creador del Canarytoken puede atacarse a s\u00ed mismo o a alguien con quien comparte el enlace. El creador de un Canarytoken PWA puede insertar Javascript en el campo de t\u00edtulo de su token PWA. Cuando el creador navega posteriormente a la p\u00e1gina de instalaci\u00f3n de su propio Canarytoken, el Javascript se ejecuta. Esto es un self-XSS. Un atacante podr\u00eda crear un Canarytoken con este self-XSS, y enviar el enlace de instalaci\u00f3n a una v\u00edctima. Cuando hacen clic en \u00e9l, el Javascript se ejecutar\u00eda. Sin embargo, no se divulgar\u00e1 informaci\u00f3n sensible (ej. informaci\u00f3n de sesi\u00f3n) al actor malicioso. Este problema ya est\u00e1 parcheado en Canarytokens.org. Los usuarios de instalaciones de Canarytokens autoalojadas pueden actualizar extrayendo la \u00faltima imagen de Docker, o cualquier imagen de Docker posterior a 'sha-7ff0e12'."}], "id": "CVE-2026-28355", "lastModified": "2026-06-17T10:28:28.313", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28355", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T20:29:36.968008Z", "version": "2.0.3"}}]}, "published": "2026-02-27T21:16:19.563", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/thinkst/canarytokens/security/advisories/GHSA-6734-fqcj-x5h3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,<sha-7ff0e12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "canarytokens", "source": "cna", "vendor": "thinkst"}, "product": "canarytokens", "vendor": "thinkst"}], "analysis": {"en": {"generated_at": "2026-04-16T15:14:51.727743+00:00", "value": {"mitigation_remediation": ["Deploy the patched Docker image with SHA\u20117ff0e12 or any newer image.", "If running a self\u2011hosted Canarytokens instance, pull the latest image and redeploy the container.", "Review and delete any existing PWA tokens whose titles contain injected JavaScript.", "Configure or enforce title field sanitization to prevent future script injections."], "summary": {"action": "Patch", "impact": "Self-initiated script execution via PWA Canarytoken title field"}, "threat_synthesis": {"affected_systems": "The issue affects the thinkst:canarytokens product, specifically the PWA token type, in all releases before commit sha\u20117ff0e12. Self\u2011hosted deployments that use older Docker images are also vulnerable.", "description_and_impact": "Canarytokens include a self\u2011persistent web app (PWA) token that stores the title text in a database. Prior to commit sha\u20117ff0e12 the title field was not sanitized, so a token creator could embed arbitrary JavaScript. When a user later opens the token\u2019s installation page, the browser executes that JavaScript in that user\u2019s context. Although the payload runs locally in the victim\u2019s browser, the supplied description indicates it does not exfiltrate session identifiers or other sensitive data, so the impact is limited to arbitrary script execution without credential theft.", "risk_and_exploitability": "The CVSS score is 1.3 and the EPSS probability is below 1\u202f%. The vulnerability is not listed in the KEV catalog. Attackers would need to craft a token with malicious title content, share the installation link and convince a victim to click it. Because the payload runs only in the victim\u2019s browser session and does not compromise server credentials, the overall exploitation likelihood remains low and the scope is limited to the victim\u2019s local environment."}}}}, "created": "2026-03-02T12:04:52.212311+00:00", "updated": "2026-04-16T15:15:39.051673+00:00", "vendors": ["thinkst", "thinkst$PRODUCT$canarytokens"]}