{"id":"CVE-2026-123498","kind":"vulnerability","aliases":["CVE-2026-123498"],"related":[],"title":"Vikunja: project titles can inject instructions into a coding agent","description":"Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction block. Attackers can craft ProjectTitle or task descriptions that the prime hook loads on SessionStart and PreCompact, causing the agent to modify the developer's checkout or run commands.","summary":"Vikunja, a task manager, puts project titles and task text verbatim into a coding agent's instruction block, so a project member with write access can plant instructions. The agent may then modify the developer's checkout or run commands.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","claude-code","coding-agents","vikunja"],"not_affected_if":["no-agent-integration"],"how_to_check":"- Check the installed Vikunja-based tooling version against the fixed release in the sources, `2.7.1`\n- Look for the prime hook that loads on SessionStart and PreCompact in the coding agent setup","fix":"- Vikunja: move to `2.7.1` or later","status":"open","published_at":"2026-11-08T02:16:37+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","triaged_at":"2026-11-08T02:26:44+00:00","updated_at":"2026-11-08T02:26:44+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-08T02:26:44Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: move to `2.7.1` or later","reach":"network","title":"Vikunja: project titles can inject instructions into a coding agent","impact":"medium","summary":"Vikunja, a task manager, puts project titles and task text verbatim into a coding agent's instruction block, so a project member with write access can plant instructions. The agent may then modify the developer's checkout or run commands.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["vikunja","coding-agents","claude-code"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"agent modifies the developer's checkout or runs commands","analyst_note":"Confirm the affected integration and whether the prime hook is the only vector, using the vendor advisory on github.com linked in the sources.","how_to_check":"- Check the installed Vikunja-based tooling version against the fixed release in the sources, `2.7.1`\n- Look for the prime hook that loads on SessionStart and PreCompact in the coding agent setup\n- unknown for anything else; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["no-agent-integration"],"who_is_affected":"Teams that connect the Vikunja task manager to a coding agent through the prime hook, where project titles or task content reach the agent's instructions. Project members with write access can plant the instructions, so teams that do not use this integration can skip it. The sources do not say which other setups are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000704,"input_tokens":4299,"output_tokens":549,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-123498':13A,16A '-2026':12A,15A '2.7.1':70C 'access':51B,82C 'agent':10A,25B,41B,56B,98C,121C 'ai':18B 'ai-tool':17B 'allow':77C 'attack':103C 'authorit':100C 'block':44B,102C 'caus':119C 'checkout':63B,127C 'claud':21B 'claude-cod':20B 'code':9A,22B,24B,40B,97C 'coding-ag':23B 'command':66B,130C 'contain':71C 'content':92C 'craft':105C 'cve':11A,14A 'descript':109C 'develop':61B,125C 'hook':113C 'inject':5A,74C,84C 'insid':95C 'instruct':6A,43B,54B,85C,101C 'load':114C 'manag':30B 'may':57B 'member':48B,79C 'modifi':59B,123C 'plant':53B 'precompact':118C 'prime':112C 'project':2A,32B,47B,78C,88C 'projecttitl':106C 'prompt':73C 'put':31B 'render':93C 'run':65B,129C 'sessionstart':116C 'set':87C 'task':29B,35B,91C,108C 'text':36B 'titl':3A,33B,89C 'tool':19B 'vean':68C 'verbatim':37B,94C 'vikunja':1A,26B,27B,67C 'vulner':75C 'write':50B,81C","nicknames":[],"mitigations":[],"who_affected":"Teams that connect the Vikunja task manager to a coding agent through the prime hook, where project titles or task content reach the agent's instructions. Project members with write access can plant the instructions, so teams that do not use this integration can skip it. The sources do not say which other setups are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","claudecode","codingagents","low","vikunja"],"campaign_type":null,"search_a":"'-123498':13A,16A '-2026':12A,15A 'agent':10A 'code':9A 'cve':11A,14A 'inject':5A 'instruct':6A 'project':2A 'titl':3A 'vikunja':1A","search_b":"'access':51B 'agent':25B,41B,56B 'ai':18B 'ai-tool':17B 'block':44B 'checkout':63B 'claud':21B 'claude-cod':20B 'code':22B,24B,40B 'coding-ag':23B 'command':66B 'develop':61B 'instruct':43B,54B 'manag':30B 'may':57B 'member':48B 'modifi':59B 'plant':53B 'project':32B,47B 'put':31B 'run':65B 'task':29B,35B 'text':36B 'titl':33B 'tool':19B 'verbatim':37B 'vikunja':26B,27B 'write':50B","search_c":"'2.7.1':70C 'access':82C 'agent':98C,121C 'allow':77C 'attack':103C 'authorit':100C 'block':102C 'caus':119C 'checkout':127C 'code':97C 'command':130C 'contain':71C 'content':92C 'craft':105C 'descript':109C 'develop':125C 'hook':113C 'inject':74C,84C 'insid':95C 'instruct':85C,101C 'load':114C 'member':79C 'modifi':123C 'precompact':118C 'prime':112C 'project':78C,88C 'projecttitl':106C 'prompt':73C 'render':93C 'run':129C 'sessionstart':116C 'set':87C 'task':91C,108C 'titl':89C 'vean':68C 'verbatim':94C 'vikunja':67C 'vulner':75C 'write':81C","first_public_at":"2026-10-22T10:00:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123498","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123498","severity":null,"published_at":"2026-11-08T02:16:37+00:00","modified_at":"2026-11-08T02:16:37+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","fetched_at":"2026-11-08T02:21:08+00:00","note":null}],"documents":[{"id":99145,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-cvh3-hf56-g9xm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:00:34+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99146,"url":"https://www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-prompt-injection-via-project-and-task-metadata","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}