CVE-2026-13140

Stored Cross-Site Scripting in Canarytokens.org

CVSS 1.1 LOWEPSS 0.2%CWE-79

Vexday Risk Score

8Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 1.1EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

24 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens. Anonymous exploitation requires knowledge of a random identifier. This issue affects Canarytokens: from Docker tag sha-4116b92cb before sha-f5aa5c4e, from Git commit 4116b92cb before f5aa5c4e.

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Affected products

Thinkst Applied Research · Canarytokens

References

https://github.com/thinkst/canarytokens/security/advisories/GHSA-23pf-xjp2-48q6