Dashboard / CVE-2026-123498

CVE-2026-123498

LOW
INFO Priority: 0.00 BB Relevance: 34/100
Published: 2026-11-08 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: Passive
S: X
AT: Present
VC: Low
VI: Low
VA: None

Description

Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction block. Attackers can craft ProjectTitle or task descriptions that the prime hook loads on SessionStart and PreCompact, causing the agent to modify the developer's checkout or run commands.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
go-vikunja vikunja 0 < 2.7.1

References & Advisories (2)

Bug Bounty Relevance

34 / 100
✓ Network accessible

CVSS Score

2.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.15%
Raw Score 0.001540
Percentile 4.6%
Date 2026-11-08

Intelligence Sources

mitre ref →
nvd ref →

External Links