HTML Injection in Thinkst Canarytokens via Google Chat Webhook

Executive Summary

CVE-2026-12888 is an HTML injection vulnerability in the Google Chat notification feature of Thinkst Applied Research Canarytokens.

The issue allows attackers to inject malicious HTML elements, such as links and images, into Google Chat notifications by exploiting unescaped fields like the User-Agent and Referer headers.

This enables interface manipulation within a Google Chat session, making the injected content appear legitimate.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves HTML injection in Google Chat webhook notifications sent by Thinkst Applied Research Canarytokens, specifically through unescaped fields such as User-Agent and Referer headers.

To detect this vulnerability on your system, you can monitor Google Chat webhook notifications for unexpected or suspicious HTML content, such as injected links or images that appear in notifications.

Since the vulnerability exploits unescaped HTTP headers, you can inspect incoming webhook requests for unusual or malicious HTML content in the User-Agent and Referer headers.

• Use network traffic capture tools like tcpdump or Wireshark to capture webhook HTTP requests and analyze headers for suspicious HTML tags.
• Example tcpdump command to capture HTTP traffic on port 80 or 443 (adjust as needed): sudo tcpdump -A -s 0 'tcp port 80 or tcp port 443'
• Use curl or similar tools to manually send test requests with HTML content in User-Agent or Referer headers to see if the system reflects them in Google Chat notifications.
• Example curl command to test injection: curl -H 'User-Agent: <a href="http://malicious.example">link</a>' -H 'Referer: <img src=x onerror=alert(1)>' https://your-canarytokens-webhook-url

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to update your Canarytokens installation to the latest patched version.

Specifically, update your Docker images to the version tagged sha-8ab4dccd or later, as this version contains the fix for the HTML injection vulnerability.

If you are using the hosted Canarytokens service, the issue has already been patched, so no further action is required.

Additionally, consider sanitizing or escaping any user-controllable input fields that are included in Google Chat notifications to prevent HTML injection.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability is an HTML injection in Google Chat notifications that allows interface manipulation but does not directly impact confidentiality, integrity, or availability of the system.

Given its low severity and lack of direct impact on core security properties, there is no explicit indication that this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows attackers to insert limited HTML content into Google Chat notifications, which can manipulate the interface and potentially deceive users by making malicious content appear legitimate.

However, the severity is considered low since it does not directly impact the confidentiality, integrity, or availability of the system.

Useful 0 Not Useful 0