Canarytokens EUVD-2026-34085

Q: What is the CVSS score of EUVD-2026-34085?

EUVD-2026-34085 has a CVSS 4.0 base score of 1.2 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Green. EPSS exploitation probability: 0.0%.

| CVE-2026-10729 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-03 0f2be0ad-3469-4e56-b38f-4eb96719b425

Docker XSS

1.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.2 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Green

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Green

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 03, 2026 - 14:31 vuln.today

DescriptionCVE.org

An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails.

This issue affects Canarytokens: from Docker tag sha-c42435e before sha-bfda4df, from Git commit c42435e before bfda4df.

AnalysisAI

HTML injection in Thinkst Applied Research Canarytokens notification emails for 'Slow Redirect' and 'Cloned Website' token types allows an attacker who triggers those tokens to embed arbitrary HTML and JavaScript into the alert email sent to the operator. If the recipient opens the notification in an HTML-rendering email client, the injected content executes within that client's context, enabling interface manipulation and XSS. This affects self-hosted Docker deployments between tag sha-c42435e and sha-bfda4df; a proof of concept exists (CVSS E:P), though no public exploit confirmed active exploitation and CISA KEV listing is absent.

Technical ContextAI

Canarytokens is a self-hosted honeypot platform by Thinkst Applied Research that generates alert emails when monitored tokens are triggered. The 'Slow Redirect' and 'Cloned Website' token types embed request-derived data (e.g., HTTP headers, user-agent, or referrer fields supplied by the triggering party) into notification email bodies. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection) identifies the root cause: attacker-controlled input from the triggering HTTP request is interpolated into email HTML without adequate escaping or sanitization, allowing raw HTML tags and script blocks to pass through into the rendered email. The vulnerability is specific to the self-hosted Docker deployment path; no CPE string was included in the advisory data.

RemediationAI

Update the self-hosted Canarytokens Docker deployment to image tag sha-bfda4df or any later commit, which represents the boundary of the fix per the affected version range in the advisory at https://github.com/thinkst/canarytokens/security/advisories/GHSA-hmjv-pj8j-8fg7. Note that the exact patched release tag sha-bfda4df is inferred from the advisory's affected-range boundary and has not been independently verified as a formally released artifact. If immediate patching is not feasible, configure email clients used by Canarytokens operators to display notifications in plain-text mode rather than rendering HTML - this prevents script execution at the cost of losing formatted email layout. Alternatively, route canary alert emails through a gateway that strips HTML before delivery; this trade-off may remove legitimate formatting from alerts. No further compensating controls are needed given the RE:L (low remediation effort) rating.