CVE-2026-11859 is an HTML injection vulnerability in the 'fetch links' email functionality of Thinkst Applied Research Canarytokens. This improper neutralization of special elements in output (CWE-74) can lead to interface manipulation and cross-site scripting (XSS) when email clients render the affected HTML emails. The vulnerability affects versions identified by Docker tag sha-c0f3cf142 and Git commit c0f3cf142 prior to sha-08c3f93d and commit 08c3f93d, respectively. No official remediation level or patch information is provided in the available data.

The vulnerability allows an attacker to inject HTML content into emails sent by Canarytokens, potentially enabling interface manipulation and XSS in email clients that render HTML. This could lead to limited user interface manipulation but does not escalate to more severe impacts such as privilege escalation or data exfiltration based on the available information. The CVSS score of 2.0 reflects a low impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or remediation level has been published. Users should monitor Thinkst Applied Research advisories for updates and apply any patches or updates once available. Until then, consider limiting exposure to the affected email content or using email clients that do not render HTML emails automatically.