CVE-2026-35600: Vikunja has HTML Injection via Task Titles in Overdue Email Notifications

Analyzed

AliasesGHSA-45q4-x4r9-8fqjGO-2026-5111

Published 10-04-2026Last modified 14-04-2026

Vulnerability summary

CVE-2026-35600 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in go-vikunja vikunja. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.6% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

32/100

0100

Medium · default modelHow is this calculated?

CVSS score

5.4/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.31%

0%100%

Low · +0.11 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2026:21483-1

Timeline

10-04-2026
PublishedVulnerability first disclosed.
14-04-2026
Last modifiedVulnerability information updated.

Description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embedded directly into Markdown link syntax in overdue email notifications without escaping Markdown special characters. When rendered by goldmark and sanitized by bluemonday (which allows <a> and <img> tags), injected Markdown constructs produce phishing links and tracking pixels in legitimate notification emails. This vulnerability is fixed in 2.3.0.