CVE-2026-123508 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja's release build tooling pulls the xgo module and Docker image by mutable latest tags rather than pinned versions. An attacker who compromises those upstream sources could get malicious code into release binaries that still carry a valid Vikunja signature.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
The risk sits in the build pipeline: teams that compile Vikunja release binaries from source using its mage release targets fetch the xgo module and Docker image at build time. Teams that only deploy published, already-built Vikunja releases are not described as exposed. unknown for whether published official binaries were affected.
Not affected if no-source-build, official-binaries-only
Who cares go, release-engineering, self-hosted, vikunja
vikunja version or the release tag, and confirm it is below 2.7.1.2.7.1 are affected; move to 2.7.1 or later.Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries shipped under a valid signature.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.