CVE-2026-115507
lowVikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names…
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/go-vikunja/vikunja disclosure@vulncheck.com
- https://github.com/go-vikunja/vikunja/blob/v2.7.0/pkg/notifications/mail.go#L132-L148 disclosure@vulncheck.com
- https://github.com/go-vikunja/vikunja/commit/18ff05932632c65dbc90a88118597989c6af4bf9 disclosure@vulncheck.com
- https://github.com/go-vikunja/vikunja/releases/tag/v2.7.1 disclosure@vulncheck.com
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rp33-8f2m-hm6j disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/vikunja-2.2.0-before-2.7.1-html-injection-via-notific... disclosure@vulncheck.com