---
id: "CVE-2026-123498"
page: "https://infrastack.ai/live/CVE-2026-123498"
kind: "vulnerability"
aliases: ["CVE-2026-123498"]
title: "Vikunja: project titles can inject instructions into a coding agent"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "claude-code", "coding-agents", "vikunja"]
not_affected_if: ["no-agent-integration"]
published_at: "2026-11-08T02:16:37+00:00"
first_seen_at: "2026-11-08T02:21:08+00:00"
updated_at: "2026-11-08T02:26:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123498", "first_seen_at": "2026-11-08T02:21:08+00:00"}]
exploit_sources: []
---

# Vikunja: project titles can inject instructions into a coding agent

Link for people: https://infrastack.ai/live/CVE-2026-123498 (this .md is for agents)

Vikunja, a task manager, puts project titles and task text verbatim into a coding agent's instruction block, so a project member with write access can plant instructions. The agent may then modify the developer's checkout or run commands.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Vikunja-based tooling version against the fixed release in the sources, `2.7.1`
- Look for the prime hook that loads on SessionStart and PreCompact in the coding agent setup

## Fix

- Vikunja: move to `2.7.1` or later

## Timeline

- 2026-11-08T02:21:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123498

## Documents

- [advisory] Vendor advisory: github.com https://github.com/go-vikunja/vikunja/security/advisories/GHSA-cvh3-hf56-g9xm
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-prompt-injection-via-project-and-task-metadata

## From the sources

Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction block. Attackers can craft ProjectTitle or task descriptions that the prime hook loads on SessionStart and PreCompact, causing the agent to modify the developer's checkout or run commands.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_