CVE-2026-123498

Vikunja versions before 2.7.1 are vulnerable to a prompt injection vulnerability (CWE-1427). Project members with write access can inject malicious instructions by setting ProjectTitle or task descriptions that are rendered verbatim within a coding agent's authoritative instruction block. Specifi...