CVE-2026-115507

Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and…

• Severity: Medium
• CVSS 5.1
• P4 · Track

Why P4: track.

Description

Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members.

Weakness

• CWE-79

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

• NVD record NVD
• CVE Program record CVE Program
• Reference NVD
• Reference NVD
• Reference NVD
• Reference NVD
• Reference NVD
• Reference NVD
• GitHub security advisory GitHub

Published 2026-10-22 · sources: NVD, GitHub Advisory Database