Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Canarytokens help track activity and actions on a network. Versions prior to `sha-7ff0e12` have a Self Cross-Site Scripting vulnerability in the "PWA" Canarytoken, whereby the Canarytoken's creator can attack themselves or someone they share the link with. The creator of a PWA Canarytoken can insert Javascript into the title field of their PWA token. When the creator later browses the installation page for their own Canarytoken, the Javascript executes. This is a self-XSS. An attacker could create a Canarytoken with this self-XSS, and send the install link to a victim. When they click on it, the Javascript would execute. However, no sensitive information (ex. session information) will be disclosed to the malicious actor. This issue is now patched on Canarytokens.org. Users of self-hosted Canarytokens installations can update by pulling the latest Docker image, or any Docker image after sha-7ff0e12.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-28355 Canarytokens help track activity and actions on a network. Versions prior to `sha-7ff0e12` have a Self Cross-Site Scripting vulnerability in the "PWA" Canarytoken, wh… https://www.cve.org/CVERecord?id=CVE-2026-28355
Post summary
The post announces CVE‑2026‑28355, detailing a Self XSS flaw in Canarytokens’ PWA before a specific commit, but provides no PoC, exploit, or patch information.
CVE-2026-28355 Self Cross-Site Scripting in Canarytokens PWA Canarytoken Before ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28355 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The tweet announces CVE‑2026‑28355, a self‑Cross‑Site Scripting flaw in Canarytokens PWA, linking to a vulnerability page but providing no PoC, exploit code, or patch details.