Threats tagged 'ghsa-3v4w-4754-gmfj'

Vikunja veans versions before 2.7.1 have a prompt injection vulnerability that allows project members with write access to inject instructions via project titles or task content. These injected instructions are rendered verbatim inside the coding agent's authoritative instruction block, potentially causing the agent to modify developer checkouts or execute commands. The vulnerability has a low CVSS score of 3.7 and requires low privileges with user interaction. No known exploits are reported in the wild, and no patch information is provided.