Threats tagged 'ghsa-q57j-qf34-3pr5'

Vikunja versions prior to 2.7.1 have a supply chain vulnerability in their mage release targets. These targets fetch the xgo module and Docker image using mutable 'latest' references. If an attacker compromises the upstream xgo module, image, or registry, they can inject malicious code into release binaries that are then signed and distributed as legitimate.