CVE-2026-123498

Project and task text could instruct a developer’s coding agent

Vikunja · Vikunja veans coding-agent CLI

First documented disclosure · Review checkpoint

Summary

A project member could influence a coding agent by editing text the agent received as authoritative instructions.

Severity and exploitation evidence

Low · 3.7/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public disclosures do not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The CLI placed remote project titles and task content inside its instruction block during agent-session preparation.

Conditions required

The attacker can edit a project or task that a developer’s coding agent reads through veans. The agent must act on the embedded content for the effect to extend beyond the prompt.

Potential impact

The agent could change the developer’s checkout or take other actions allowed by its existing permissions.

Affected versions and configurations

Versions before 2.7.1 in the CNA record.

Fix and mitigation status

2.7.1, as listed by the project and CNA.

Practical next steps

Install the fix listed for 2.7.1. The project describes a server trust check and separate, labeled rendering of remote task content.

Operating lesson

Treat task text as untrusted even when it comes from a trusted collaboration server.

Evidence and limits

At disclosure veans had no separately tagged release. Both the maintainer’s advisory and the CNA identify 2.7.1 as patched.

Sources