CVE-2026-35600 is a cross-site scripting vulnerability (CWE-79) in the open-source task management platform Vikunja, affecting versions before 2.3.0. The flaw occurs because task titles are embedded directly into Markdown link syntax in overdue email notifications without escaping Markdown special characters. When these emails are rendered by the goldmark Markdown processor and sanitized by bluemonday (which permits <a> and <img> tags), malicious Markdown can produce phishing links and tracking pixels. This vulnerability allows an attacker with limited privileges to inject content that could deceive users receiving notification emails. The vulnerability has a CVSS 3.1 score of 5.4 (medium severity) and is fixed in Vikunja version 2.3.0.

The vulnerability enables attackers with limited privileges to inject malicious Markdown into task titles that are included in overdue email notifications. This can result in phishing links and tracking pixels being embedded in legitimate emails, potentially leading to user deception and privacy violations. There is no indication of impact on system availability. No known exploits are reported in the wild.

This vulnerability is fixed in Vikunja version 2.3.0. Users should upgrade to version 2.3.0 or later to remediate this issue. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in 2.3.0. No additional mitigation steps are indicated.