CVE-2026-123529 Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123529?
CVE-2026-123529 is a medium-severity vulnerability in go-vikunja vikunja, published on 8 Nov 2026.
Official description
Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport phishing overlays or force zero-click outbound background-image requests that deanonymize viewers.
Weakness: CWE-1021
Which versions are affected by CVE-2026-123529?
How do I fix CVE-2026-123529?
No fix has been published for CVE-2026-123529 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123529 being exploited?
There is no known exploitation of CVE-2026-123529 in the wild and no public exploit code.
Sources
Also known as GHSA-p23m-cq25-pc4j, GHSA-rvvf-8m26-2qwr.