CVE-2026-115507
Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header
CVSS Score
3.5
EPSS Score
0.0%
EPSS Percentile
0th
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members.
| CWE | CWE-79 |
| Vendor | go-vikunja |
| Product | vikunja |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for go-vikunja vikunja
Be the first to know when new low vulnerabilities affecting go-vikunja vikunja are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
go-vikunja / vikunja
2.2.0 < 2.7.1
References
github.com: https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rp33-8f2m-hm6j github.com: https://github.com/go-vikunja/vikunja/commit/18ff05932632c65dbc90a88118597989c6af4bf9 github.com: https://github.com/go-vikunja/vikunja/blob/v2.7.0/pkg/notifications/mail.go#L132-L148 github.com: https://github.com/go-vikunja/vikunja/releases/tag/v2.7.1 github.com: https://github.com/go-vikunja/vikunja vulncheck.com: https://www.vulncheck.com/advisories/vikunja-2.2.0-before-2.7.1-html-injection-via-notification-email-header
Credits
Siyang Wu