Supply Chain Vulnerability in Vikunja by Vicuna Technologies

CVE-2026-123508

What is CVE-2026-123508?

Vikunja, prior to version 2.7.1, is susceptible to a supply chain vulnerability that arises from its use of mutable references for fetching the xgo module and Docker image. This design flaw allows attackers to compromise the upstream xgo module, image, or registry, enabling them to inject malicious code into binaries that are subsequently built and distributed, all under the guise of a valid signature. Users are advised to update their installations to mitigate the risks associated with this vulnerability.

References