CVE-2026-13140CWE-79
Stored Cross-Site Scripting in Canarytokens.org
Low · published June 24, 2026
What it is
Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens.
Anonymous exploitation requires knowledge of a random identifier.
This issue affects Canarytokens: from Docker tag sha-4116b92cb before sha-f5aa5c4e, from Git commit 4116b92cb before f5aa5c4e.
The record
Technical detail
- CVSS v4.0
- 1.1 · LOW
- Vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
- EPSS
- 0.00295 · 21.1th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2026-06-24T11:12Z
EPSS history
Timeline