CVE-2026-28355 Overview
A Self Cross-Site Scripting (XSS) vulnerability has been identified in Canarytokens, a tool designed to help track activity and actions on a network. The vulnerability exists in the "PWA" (Progressive Web App) Canarytoken feature, where the token creator can inject malicious JavaScript into the title field of their PWA token. When the creator or any user they share the installation link with browses the installation page, the injected JavaScript executes in their browser context.
While this is classified as a self-XSS vulnerability with limited direct impact, it can be weaponized through social engineering by convincing victims to visit a specially crafted installation link. However, the vulnerability does not expose sensitive information such as session data to the attacker.
Critical Impact
Self-XSS vulnerability in PWA Canarytokens allows JavaScript injection in the title field, potentially affecting users who click on malicious installation links.
Affected Products
- Canarytokens versions prior to sha-7ff0e12
- Self-hosted Canarytokens installations running Docker images before sha-7ff0e12
- Canarytokens.org (patched)
Discovery Timeline
- 2026-02-27 - CVE CVE-2026-28355 published to NVD
- 2026-03-02 - Last updated in NVD database
Technical Details for CVE-2026-28355
Vulnerability Analysis
This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The root issue stems from improper input validation and output encoding in the PWA Canarytoken title field handling.
When a user creates a PWA Canarytoken, they can specify a title for the token. The application fails to properly sanitize or encode this input before rendering it on the installation page. This allows arbitrary JavaScript code to be embedded in the title field, which then executes when the installation page is viewed in a browser.
The attack requires user interaction—a victim must click on the malicious installation link for the JavaScript to execute. While no sensitive session information is disclosed to attackers, the execution of arbitrary JavaScript opens possibilities for phishing attacks, UI manipulation, or redirect-based attacks within the context of the vulnerable page.
Root Cause
The vulnerability originates from insufficient input validation and improper output encoding in the PWA Canarytoken title field. The application accepts user-controlled input in the title parameter and reflects it directly into the HTML of the installation page without adequate sanitization, allowing JavaScript payloads to be executed in the browser context of any user viewing the page.
Attack Vector
The attack leverages network-based access with no authentication required. An attacker would create a PWA Canarytoken with malicious JavaScript embedded in the title field, then share the installation link with potential victims through phishing emails, social media, or other communication channels.
The exploitation flow involves:
- Attacker creates a PWA Canarytoken with JavaScript payload in the title field
- Attacker obtains the installation link for the malicious token
- Attacker distributes the link to potential victims via social engineering
- Victim clicks the installation link and views the page
- JavaScript payload executes in the victim's browser context
See the GitHub Security Advisory for detailed technical information about this vulnerability.
Detection Methods for CVE-2026-28355
Indicators of Compromise
- Presence of JavaScript code patterns in PWA Canarytoken title fields (e.g., <script> tags, event handlers like onerror, onload)
- Installation page requests containing URL-encoded script elements in token parameters
- User reports of unexpected browser behavior when accessing Canarytoken installation pages
Detection Strategies
- Implement Content Security Policy (CSP) headers to detect and block inline script execution
- Monitor web application firewall (WAF) logs for XSS patterns in request parameters
- Review Canarytoken creation logs for suspicious title field content containing HTML or JavaScript syntax
- Deploy browser-based XSS detection extensions for security team members accessing installation pages
Monitoring Recommendations
- Enable logging for all Canarytoken creation events and inspect title fields for script injection patterns
- Configure alerting for CSP violation reports if implemented
- Monitor outbound network connections from installation pages for unexpected external resource requests
- Review user-submitted Canarytoken configurations periodically for malicious content
How to Mitigate CVE-2026-28355
Immediate Actions Required
- Update Canarytokens to version sha-7ff0e12 or later immediately
- For self-hosted installations, pull the latest Docker image from the official repository
- Canarytokens.org users are already protected as the platform has been patched
- Educate users about the risks of clicking on Canarytoken installation links from untrusted sources
Patch Information
The vulnerability has been patched in Canarytokens.org and in Docker images starting from sha-7ff0e12. Users of self-hosted Canarytokens installations should update by pulling the latest Docker image. The patch implements proper input sanitization and output encoding for the PWA Canarytoken title field to prevent JavaScript injection.
For more details, refer to the GitHub Security Advisory.
Workarounds
- Until patching is possible, restrict access to Canarytoken creation functionality to trusted users only
- Implement network-level filtering to block installation page requests containing script patterns
- Educate users to avoid clicking on Canarytoken installation links received from external or untrusted sources
- Consider temporarily disabling PWA Canarytoken functionality in self-hosted installations until the update can be applied
# Update self-hosted Canarytokens Docker image
docker pull thinkst/canarytokens:latest
# Or pull the specific patched version
docker pull thinkst/canarytokens:sha-7ff0e12
# Restart the container with the updated image
docker-compose down && docker-compose up -d
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
