This vulnerability is a stored cross-site scripting (CWE-79) in the AWS API key store of Thinkst Applied Research Canarytokens. An attacker who knows a random identifier can exploit this to inject malicious scripts that are stored and later executed in the context of a user's browser. The affected versions are those between Docker tag sha-4116b92cb and before sha-f5aa5c4e, and Git commits from 4116b92cb before f5aa5c4e. The product is a cloud service, and the vendor manages the service environment.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the Canarytokens web interface, potentially leading to session hijacking or other client-side impacts. However, the CVSS score is low (1.1), reflecting limited attack complexity and impact. Anonymous exploitation requires knowledge of a random identifier, which limits the attack surface. No known exploits in the wild have been reported.

The vendor manages remediation for this cloud-hosted service. A patch is available, and users should verify with Thinkst Applied Research's advisory for the latest status and ensure their service instance is updated. Since this is a cloud service, the vendor typically applies fixes server-side. Users should monitor vendor communications for confirmation of remediation.