CVE-2026-115507: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in go-vikunja vikunja

CVE-2026-115507 is an HTML injection vulnerability in Vikunja's CreateConversationalHeader function located in pkg/notifications/mail.go. The vulnerability arises because display names and task/project titles are interpolated directly into email anchor tags without proper neutralization. Authenticated users can exploit this by crafting titles or display names that close the anchor tag and inject arbitrary HTML content, such as phishing links, into notification emails sent to project members. This affects Vikunja versions from 2.2.0 up to but excluding 2.7.1.

An authenticated user can inject malicious HTML content into notification emails, potentially enabling phishing attacks against project members receiving these emails. This could lead to users clicking on malicious links embedded in otherwise legitimate notification emails. The CVSS 4.0 score is 5.1 (medium severity), reflecting network attack vector, low attack complexity, and limited impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, restrict the ability of users to create or modify display names and task/project titles or sanitize inputs to prevent injection. Monitor vendor communications for an official fix or update.