# CVE-2026-10729: Thinkst Canarytokens HTML injection in notification emails

Source: https://junglewise.ai/threats/cve-2026-10729-thinkst-canarytokens-html-injection-in-notification-emails  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-03. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-10729 · Severity: info · CVSS 2.1 · Published 2026-06-03

Thinkst Canarytokens is a tool used to create 'honeytokens' that alert administrators when an attacker interacts with them. A vulnerability in the "Slow Redirect" and "Cloned Website" token types allows an attacker to inject malicious HTML into the alert emails sent to administrators. This could be used to trick security staff into clicking phishing links or viewing unauthorized images within their email client during an investigation.

Technologies: [Thinkst Applied Research Canarytokens](https://junglewise.ai/threats/technologies/canarytokens). Vendors: [Thinkst Applied Research](https://junglewise.ai/threats/vendors/thinkst-applied-research).

## Quick answers

**Is CVE-2026-10729 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10729 being exploited in the wild.

**How severe is CVE-2026-10729?** Informational severity, with a CVSS score of 2.1, published 3 June 2026.

**Which products and versions are affected?** Thinkst Applied Research Canarytokens Docker tags sha-c42435e before sha-bfda4df; Git commits c42435e before bfda4df.

**Is there a fix for CVE-2026-10729?** A patch was published on 2026-06-03. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10729 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10729?** Check whether you run Thinkst Applied Research Canarytokens at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An HTML injection vulnerability exists in the "Slow Redirect" and "Cloned Website" Canarytokens due to improper neutralization of the 'location' field. When these tokens are triggered, the unescaped 'location' data is included directly in the notification email sent to the user. An attacker can exploit this by providing malicious HTML in the location field, which may be rendered by the recipient's email client. While many modern email clients strip script tags, this flaw still enables interface manipulation, the insertion of phishing links, or the inclusion of external images. The issue is fixed in Docker images and Git commits following sha-bfda4df.

## Affected products

- Thinkst Applied Research Canarytokens Docker tags sha-c42435e before sha-bfda4df; Git commits c42435e before bfda4df

## Timeline

- 2026-06-03: disclosed
- 2026-06-03: advisory
- 2026-06-03: patched

## References

- [https://github.com/thinkst/canarytokens/security/advisories/GHSA-hmjv-pj8j-8fg7](https://github.com/thinkst/canarytokens/security/advisories/GHSA-hmjv-pj8j-8fg7)

## Related threats

- [Thinkst Canarytokens stored XSS in AWS API key store](https://junglewise.ai/threats/cve-2026-13140-thinkst-canarytokens-stored-xss-in-aws-api-key-store)
- [Thinkst Canarytokens HTML injection in Google Chat notifications](https://junglewise.ai/threats/cve-2026-12888-thinkst-canarytokens-html-injection-in-google-chat-notifications)
- [Thinkst Canarytokens HTML injection in fetch links email](https://junglewise.ai/threats/cve-2026-11859-thinkst-canarytokens-html-injection-in-fetch-links-email)