Stored CSS Injection Vulnerability in Vikunja Product by Vikunja

CVE-2026-123529

What is CVE-2026-123529?

Vikunja prior to version 2.7.1 contains a vulnerability that allows authenticated users with project write access to execute CSS injection attacks. This can occur through the use of unsanitized 'data-background-color' attributes in table-cell data. Attackers can exploit this by inputting deceptive task descriptions or comments, which may lead to the creation of phishing overlays that cover the entire viewport or trigger zero-click outbound requests that compromise user privacy.

References