CVE-2026-12888

lowpriority · track · 0EPSS 0.004 · 38 %ileEU

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.44% (38th) EPSS

CVSS 2 · low

Is it mine?

2 products

Check your exposure

Who says so?

2 sources

cnnvd · enisa_euvd

EPSS · scored 2026-10-27

An HTML injection vulnerability exists in the Google Chat webhook notification sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links. This issue affects Canarytokens: from Docker tag sha-4aef1db90 before sha-8ab4dccd, from Git commit 4aef1db90 before 8ab4dccd.

cvss

Technical severity, 0–10. One row per scoring source.

2.0

010

base score 0–10 · higher = more severe · hover a vector to decode

v4.02lowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/AU:N/RE:L/U:Greensecondary · ENISA EU

v4.02lowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Greensecondary

v4.01.2lowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Greensecondary · CVSS-BT (t0sche)