medium4.3
CVE-2026-92839
Canva Desktop before v1.125.0 performed double decoding in the deeplink handler.
Impact
Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’s session.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Canva | Canva Desktop | before 1.125.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.