PT-2026-22402
CVE-2026-28355
·
Published
2026-02-27
·
Updated
2026-02-28
Description by
CVSS 4.0
1.3
LowMetricsAV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Name of the Vulnerable Software and Affected Versions
Canarytokens versions prior to
sha-7ff0e12Description
The Canarytokens PWA Canarytoken has a Self Cross-Site Scripting issue. A Canarytoken creator can execute Javascript code by inserting it into the title field of their PWA token. This allows the creator to attack themselves or anyone they share the link with. When a victim clicks on the installation link, the Javascript code executes. However, no sensitive information is disclosed to a malicious actor.
Recommendations
Update to a Docker image after
sha-7ff0e12 or pull the latest Docker image from Canarytokens.org. Found an issue in the description? Have something to add? Feel free to write us 👾