CVE-2026-123498 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Vikunja, a task manager, puts project titles and task text verbatim into a coding agent's instruction block, so a project member with write access can plant instructions. The agent may then modify the developer's checkout or run commands.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that connect the Vikunja task manager to a coding agent through the prime hook, where project titles or task content reach the agent's instructions. Project members with write access can plant the instructions, so teams that do not use this integration can skip it. The sources do not say which other setups are affected.
Not affected if no-agent-integration
Who cares claude-code, coding-agents, vikunja
2.7.12.7.1 or laterVikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction block. Attackers can craft ProjectTitle or task descriptions that the prime hook loads on SessionStart and PreCompact, causing the agent to modify the developer's checkout or run commands.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.