Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.7.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Vikunja, a self-hosted task and project management application, is affected. An authenticated user can insert crafted display names or task and project titles that inject malicious HTML, such as phishing links, into notification emails sent to other project members.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- go-vikunja vikunja
From 2.2.0 · fixed in 2.7.1