CVE-2026-92839 in Canva
Summary
by MITRE • 09/17/2026
Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’s session.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in Canva Desktop versions prior to 1.125.0 stems from a critical implementation flaw within the application's deep link handling mechanism, specifically characterized as double decoding or improper neutralization of special elements. This type of error typically occurs when an input value is decoded multiple times without proper validation between each step, allowing attackers to bypass security checks that rely on single-pass parsing logic. In this specific context, the desktop client failed to adequately sanitize or validate URLs received through deep link protocols before processing them for navigation or content loading operations. The core technical flaw lies in the application's failure to recognize that a double-encoded payload could evade initial filtering rules designed to block malicious scripts or unauthorized resource loads, effectively creating an opening for same-origin attacks.
From a technical perspective, this vulnerability exploits the browser-like engine embedded within the desktop application. When a user interacts with a specially crafted deep link, the application decodes the URL once to determine its intent and potentially performs a second decoding step during content rendering or navigation. If the initial security controls only check for malicious patterns in their encoded form, an attacker can encode harmful payloads twice so that after the first decode they still appear benign, but after the second decode they become executable code or valid paths to sensitive resources. This mechanism allows a threat actor to trick the application into loading arbitrary content from domains that are considered same-origin as the Canva web interface. Because the loaded content shares the same origin privileges, it inherits full access to cookies, local storage, and session tokens associated with the user's active login state.
The operational impact of this vulnerability is significant for end-users who rely on Canva Desktop for professional design work involving sensitive client data or proprietary intellectual property. By leveraging double decoding in the deep link handler, an attacker can execute cross-site scripting-like attacks within the trusted context of the application. This enables the theft of session cookies and authentication tokens, leading to account takeover scenarios where unauthorized parties gain full control over a user's Canva workspace. Furthermore, since the loaded content is same-origin, it can interact directly with the application's internal APIs and DOM structure, potentially allowing for data exfiltration, modification of design files without authorization, or further pivoting into other connected services if single sign-on mechanisms are in place. The ability to load arbitrary content also opens avenues for phishing attacks disguised as legitimate Canva interfaces within the desktop environment, eroding user trust and compromising confidentiality.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-20 Improper Input Neutralization for Inputs Used by a Command or Program, specifically reflecting issues related to input validation bypass through encoding tricks. It also maps closely to MITRE ATT&CK technique T1564.003 Hidden Windows and Processes, as the attacker utilizes legitimate application features (deep links) to execute unauthorized actions invisibly within the trusted environment. Additionally, it relates to CWE-79 Cross-site Scripting if interpreted through the lens of web view injection, although in a desktop context it is more accurately described as arbitrary code execution or privilege escalation via same-origin abuse.
To mitigate this risk, organizations and individual users must ensure that Canva Desktop is updated to version 1.125.0 or later immediately upon availability. The vendor has addressed the double decoding flaw by implementing stricter input validation and ensuring that deep link handlers properly normalize URLs before processing them against security policies. In environments where automatic updates are not feasible, administrators should enforce patch management protocols to keep desktop applications current with the latest security fixes. Additionally, users should be educated on the risks of clicking unsolicited links or QR codes, even if they appear to originate from trusted services like Canva, as social engineering often accompanies such technical exploits. Monitoring for unusual account activity and enabling multi-factor authentication where supported can provide an additional layer of defense against potential account compromise resulting from this vulnerability.