← Vulnerability feed

Vulnerability record · CVE-2024-28111 · published 6 March 2024

CVE-2024-28111: Thinkst canarytokens csv injection vulnerability

Thinkst · Canarytokens

Canarytokens helps track activity and actions on a network. Canarytokens.org supports exporting the history of a Canarytoken's incidents in CSV format. The generation of these CSV files is vulnerable to a CSV Injection vulnerability. This flaw can be used by an attacker who discovers an HTTP-based Canarytoken to target the Canarytoken's owner, if the owner exports the incident history to CSV and opens in a reader application such as Microsoft Excel. The impact is that this issue could lead to code execution on the machine on which the CSV file is opened. Version sha-c595a1f8 contains a fix for this issue.

6.5 CVSS 3.1 Medium EPSS 0.63% · top 51.7% CWE-1236 · CSV injection
6.5CVSS 3.1 base score
0.63%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Canarytokens helps track activity and actions on a network. Canarytokens.org supports exporting the history of a Canarytoken's incidents in CSV format. The generation of these CSV files is vulnerable to a CSV Injection vulnerability. This flaw can be used by an attacker who discovers an HTTP-based Canarytoken to target the Canarytoken's owner, if the owner exports the incident history to CSV and opens in a reader application such as Microsoft Excel. The impact is that this issue could lead to code execution on the machine on which the CSV file is opened. Version sha-c595a1f8 contains a fix for this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/thinkst/canarytokens/commit/c595a1f884b986da2ca05aa5bff9ae5f93c6a4aa Patch
https://github.com/thinkst/canarytokens/security/advisories/GHSA-fqh6-v4qp-65fv Vendor Advisory
https://github.com/thinkst/canarytokens/commit/c595a1f884b986da2ca05aa5bff9ae5f93c6a4aa Patch
https://github.com/thinkst/canarytokens/security/advisories/GHSA-fqh6-v4qp-65fv Vendor Advisory

Track CVE-2024-28111 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2019-9768Thinkst canarytokens permissions and access controls vulnerabilityThinkst Canarytokens through commit hash 4e89ee0 (2019-03-01) relies on limited variation in size, metadata, and timestamp, which makes it easier for…EPSS 12%6.1CVE-2023-22475Thinkst canarytokens cross-site scripting vulnerabilityCanarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identified in th…EPSS 0.52%6.1CVE-2022-31113Thinkst canarytokens cross-site scripting vulnerabilityCanarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identified in th…EPSS 0.58%

Source: NIST National Vulnerability Database (record CVE-2024-28111), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.