CVE-2026-115507

EUVD-2026-108339
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.5 LOW
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 8.88%
Common Weakness Enumeration
References
https://github.com/go-vikunja/vikunja
https://github.com/go-vikunja/vikunja/blob/v2.7.0/pkg/notifications/mail.go#L132-L148
https://github.com/go-vikunja/vikunja/commit/18ff05932632c65dbc90a88118597989c6af4bf9
https://github.com/go-vikunja/vikunja/releases/tag/v2.7.1
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rp33-8f2m-hm6j
https://www.vulncheck.com/advisories/vikunja-2.2.0-before-2.7.1-html-injection-via-notification-email-header