{"id":"CVE-2026-35600","sourceIdentifier":"security-advisories@github.com","published":"2026-04-10T17:17:03.680","lastModified":"2026-10-26T21:10:00.170","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embedded directly into Markdown link syntax in overdue email notifications without escaping Markdown special characters. When rendered by goldmark and sanitized by bluemonday (which allows <a> and <img> tags), injected Markdown constructs produce phishing links and tracking pixels in legitimate notification emails. This vulnerability is fixed in 2.3.0."},{"lang":"es","value":"Vikunja es una plataforma de gestión de tareas de código abierto y autoalojada. Antes de la versión 2.3.0, los títulos de las tareas se incrustan directamente en la sintaxis de enlaces de Markdown en las notificaciones por correo electrónico de tareas vencidas sin escapar los caracteres especiales de Markdown. Cuando son renderizados por goldmark y saneados por bluemonday (que permite las etiquetas [a] e [img]), las construcciones de Markdown inyectadas producen enlaces de phishing y píxeles de seguimiento en correos electrónicos de notificación legítimos. Esta vulnerabilidad se corrigió en la versión 2.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"go-vikunja","product":"vikunja","versions":[{"version":"< 2.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-14T15:01:04.698920Z","id":"CVE-2026-35600","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*","versionEndExcluding":"2.3.0","matchCriteriaId":"CC8B46CF-6E7B-46F4-8275-D1A38F2A6D5E"}]}]}],"references":[{"url":"https://github.com/go-vikunja/vikunja/commit/0f3730d045f20e261e3cdfc6d93c325653395b64","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/go-vikunja/vikunja/pull/2580","source":"security-advisories@github.com","tags":["Issue Tracking"]},{"url":"https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-45q4-x4r9-8fqj","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}