CVE-2026-35600
published 2026-04-10CVE-2026-35600: Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embedded directly into Markdown link syntax in overdue email…
PriorityP427medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.19%
9.4th percentile
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embedded directly into Markdown link syntax in overdue email notifications without escaping Markdown special characters. When rendered by goldmark and sanitized by bluemonday (which allows and tags), injected Markdown constructs produce phishing links and tracking pixels in legitimate notification emails. This vulnerability is fixed in 2.3.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.vikunja.io | api | >= 0 < 2.3.0 | 2.3.0 |
| go-vikunja | vikunja | < 2.3.0 | 2.3.0 |
| vikunja | vikunja | < 2.3.0 | 2.3.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Vikunja has HTML Injection via Task Titles in Overdue Email Notifications
ghsa·2026-04-10
CVE-2026-35600 [MEDIUM] CWE-79 Vikunja has HTML Injection via Task Titles in Overdue Email Notifications
Vikunja has HTML Injection via Task Titles in Overdue Email Notifications
## Summary
Task titles are embedded directly into Markdown link syntax in overdue email notifications without escaping Markdown special characters. When rendered by goldmark and sanitized by bluemonday (which allows `` and `` tags), injected Markdown constructs produce phishing links and tracking pixels in legitimate notification emails.
## Details
The overdue task notification at `pkg/models/notifications.go:360` constructs a Markdown list entry:
```go
overdueLine += `* [` + task.Title + `](` + config.ServicePublicURL.GetString() + "tasks/" + strconv.FormatInt(task.ID, 10) + `) ...`
```
The task title is placed inside Markdown link syntax `[TITLE](URL)`. A title containing `]` and `[` breaks the link structure
VulDB
go-vikunja up to 2.2.x Email Notification cross site scripting (GHSA-45q4-x4r9-8fqj)
vuldb·2026-04-10·CVSS 5.4
CVE-2026-35600 [MEDIUM] go-vikunja up to 2.2.x Email Notification cross site scripting (GHSA-45q4-x4r9-8fqj)
A vulnerability labeled as problematic has been found in go-vikunja vikunja up to 2.2.x. This affects an unknown function of the component Email Notification Handler. Such manipulation leads to cross site scripting.
This vulnerability is referenced as CVE-2026-35600. It is possible to launch the attack remotely. No exploit is available.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-10
Published