CVE-2026-12888 is an HTML injection vulnerability in Thinkst Applied Research Canarytokens' Google Chat webhook notification system. The vulnerability allows attackers to inject limited HTML elements, such as links, into notifications, causing interface manipulation within Google Chat. The affected versions are identified by Docker tags and Git commits between sha-4aef1db90 and sha-8ab4dccd. There is no vendor advisory indicating a fix or mitigation, and no known exploits are reported in the wild. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, user interaction needed, and low impact on confidentiality, integrity, and availability.

The vulnerability enables an attacker to inject limited HTML content into Google Chat notifications generated by Canarytokens, potentially manipulating the interface seen by users. The impact is limited due to the low CVSS score and the requirement for user interaction. There is no indication of direct compromise of system confidentiality, integrity, or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with Google Chat notifications generated by affected Canarytokens versions and avoid interacting with suspicious links or content.