CVE-2026-35600 go-vikunja CVE debrief

Who should care

Defenders responsible for Vikunja instances, particularly those using email notifications, should assess exposure and verify updates to version 2.3.0 or later. Roles include system administrators, security teams, and IT personnel managing task management platforms.

Why it matters

CVE-2026-35600 is a medium-severity vulnerability in Vikunja that allows for phishing links and tracking pixels to be injected into legitimate email notifications. Defenders should prioritize verifying and updating Vikunja instances to version 2.3.0 or later, and review overdue email notifications for potential phishing links or tracking pixels. The vulnerability requires verification from official sources, and its impact and remediation are supported by source-provided information.

• Potential for phishing attacks through injected links in email notifications
• Possible tracking of email recipients through injected tracking pixels
• Need for verification of Vikunja instance updates to version 2.3.0 or later
• Importance of monitoring email notifications for suspicious activity

Technical summary

The vulnerability in Vikunja allows task titles to be embedded directly into Markdown link syntax in overdue email notifications without proper escaping of Markdown special characters. This enables injected Markdown constructs to produce phishing links and tracking pixels in legitimate notification emails. The issue was fixed in version 2.3.0. Defenders should prioritize verifying and updating Vikunja instances to version 2.3.0 or later, and review overdue email notifications for potential phishing links or tracking pixels. The vulnerability requires verification from official sources, and its impact and remediation are supported by source-provided information.

Defensive priority

Defenders should prioritize verifying and updating Vikunja instances to version 2.3.0 or later, and review overdue email notifications for potential phishing links or tracking pixels.

Recommended defensive actions

• Verify and update Vikunja instances to version 2.3.0 or later
• Review overdue email notifications for potential phishing links or tracking pixels
• Monitor for suspicious email activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported and fixed by the Vikunja developers, with a patch released in version 2.3.0. The issue involves task titles being embedded directly into Markdown link syntax in overdue email notifications without proper escaping, allowing for injected Markdown constructs to produce phishing links and tracking pixels.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.