CVE-2026-92839

Published: Sep 17, 2026Modified: Sep 18, 2026Deferred

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: 61adb53e-e4b3-47f7-8a93-4717c9e77dc6 (Secondary)

Description

Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’s session.

Related CWEs

CWE-174

Double Decoding of the Same Data

The product decodes the same input twice, which can limit the effectiveness of any protection mechanism that occurs in between the decoding operations.

References (1)

https://trust.canva.com/?tcuUid=d98fa5aa-50ac-4e45-8fec-2c8d07f2b9b6

Source: 61adb53e-e4b3-47f7-8a93-4717c9e77dc6

Timeline

No history available yet.