Log in Start free

Vulnerability · Published Apr 10, 2026 · Assigned by GitHub_M

CVE-2026-35600Vikunja has HTML Injection via Task Titles in Overdue Email Notifications

Medium 5.4

In plain English

A medium-severity cross-site scripting in vikunja from go-vikunja. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 90.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embedded directly into Markdown link syntax in overdue email notifications without escaping Markdown special characters. When rendered by goldmark and sanitized by bluemonday (which allows <a> and <img> tags), injected Markdown constructs produce phishing links and tracking pixels in legitimate notification emails. This vulnerability is fixed in 2.3.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gocode.vikunja.io/api2.3.0GHSA-45q4-x4r9-8fqj
Gocode.vikunja.io/apino fix listedGO-2026-5111

Affected products (as reported)

VendorProductVersions
go-vikunja vikunja < 2.3.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References