LOW 2.1 NVD
CVE-2026-123498
Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project tit
Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction block. Attackers can craft ProjectTitle or task descriptions that the prime hook loads on SessionStart and PreCompact, causing the agent to modify the developer's checkout or run commands.
References
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-cvh3-hf56-g9xm
- https://www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-prompt-injection-via-proje
This low severity vulnerability with a CVSS score of 2.1 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.