CVE-2026-123496

Project links let veans write outside the checkout

Vikunja · Vikunja veans coding-agent CLI

First documented disclosure · Review checkpoint

Summary

Initializing veans in an untrusted checkout could alter files or install coding-agent hooks beyond the project.

Severity and exploitation evidence

Low · 3.3/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public disclosures do not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The initialization process followed repository-provided filesystem links when writing configuration and hooks.

Conditions required

A developer runs initialization in a checkout with links controlled by someone else. The destination must be writable by the developer.

Potential impact

Files could be overwritten or hooks installed in shared user settings. The advisory does not establish attacker-chosen code execution.

Affected versions and configurations

Versions before 2.7.1 in the CNA record.

Fix and mitigation status

2.7.1, as listed by the project and CNA.

Practical next steps

Install the fix listed for 2.7.1. Review user-level agent hooks and configuration after initializing an affected checkout.

Operating lesson

Keep project initialization writes inside the project directory, including after resolving links.

Evidence and limits

At disclosure veans had no separately tagged release. Both the maintainer’s advisory and the CNA identify 2.7.1 as patched.

Sources