Vulnerability · Published Oct 22, 2026 · Assigned by VulnCheck

CVE-2026-115507Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header

Low 3.5

In plain English

A low-severity cross-site scripting in vikunja from go-vikunja. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.3%top 79.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members.

Affected products (as reported)

Vendor	Product	Versions
go-vikunja	vikunja	2.2.0 – before 2.7.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-rp33-8f2m-hm6j) vendor-advisory
https://github.com/go-vikunja/vikunja/commit/18ff05932632c65dbc90a88118597989c6af4bf9 patch
https://github.com/go-vikunja/vikunja/blob/v2.7.0/pkg/notifications/mail.go#L132-L148 technical-description
vikunja v2.7.1 Release Notes release-notes
https://github.com/go-vikunja/vikunja product
VulnCheck Advisory: Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header third-party-advisory