CVE-2026-123498 Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123498?
CVE-2026-123498 is a low-severity vulnerability in go-vikunja vikunja, published on 8 Nov 2026.
Official description
Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction block. Attackers can craft ProjectTitle or task descriptions that the prime hook loads on SessionStart and PreCompact, causing the agent to modify the developer's checkout or run commands.
Weakness: CWE-1427
Which versions are affected by CVE-2026-123498?
How do I fix CVE-2026-123498?
No fix has been published for CVE-2026-123498 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123498 being exploited?
There is no known exploitation of CVE-2026-123498 in the wild and no public exploit code.
Sources
Also known as GHSA-3v4w-4754-gmfj, GHSA-cvh3-hf56-g9xm.