Low 5.1

Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader...

CVE-2026-115507 First seen on SecPulse 04:14

Affected packages

Ecosystem	Package	Affected	Fixed
go-vikunja	vikunja	≥ 2.2.0, < 2.7.1	2.7.1

Original description The description as published by the source.

Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Low 3.5; CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4: Medium 5.1; CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Published: Oct 23, 2026
First seen on SecPulse: 04:14
GHSA: GHSA-j37p-9r5c-rjgj
CWE: CWE-79

NVD GitHub Advisory

Tags(click for explanation)

CWE

Cwe 79

All

Go Vikunja Vikunja

Detection sources

NIST National Vulnerability Database05:17
GitHub Security Advisories (Global)06:32
CVE.org (CVE Program・cvelistV5)04:14