CVE-2026-123498
Deferred
Deferred - Pending Action
Prompt Injection in Vikunja Before 2.7.1
Vulnerability report for CVE-2026-123498, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-08
Last updated on: 2026-11-08
Assigner: VulnCheck
Description
Description
Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction block. Attackers can craft ProjectTitle or task descriptions that the prime hook loads on SessionStart and PreCompact, causing the agent to modify the developer's checkout or run commands.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| go-vikunja | vikunja | to 2.7.1 (exc) |
| go-vikunja | veans | to 2.7.1 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
