What’s Vulnerable › Vulnerabilities

CVE-2026-35600: Vikunja has HTML Injection via Task Titles in Overdue Email Notifications

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-10 · updated 2026-10-26
• Weakness: CWE-79

Description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embedded directly into Markdown link syntax in overdue email notifications without escaping Markdown special characters. When rendered by goldmark and sanitized by bluemonday (which allows <a> and <img> tags), injected Markdown constructs produce phishing links and tracking pixels in legitimate notification emails. This vulnerability is fixed in 2.3.0.

Affected products

• go-vikunja vikunja: before 2.3.0 — fixed in 2.3.0

How to fix

Upgrade to a fixed version: go-vikunja vikunja 2.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/go-vikunja/vikunja/commit/0f3730d045f20e261e3cdfc6d93c325653395b64
• https://github.com/go-vikunja/vikunja/pull/2580
• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-45q4-x4r9-8fqj

Get alerted when CVE-2026-35600 or the next vulnerability affects your stack