# CVE-2026-123529: Vikunja stored CSS injection in rich-text table cells

Source: https://junglewise.ai/threats/cve-2026-123529-vikunja-before-2-7-1-contains-a-stored-css-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-123529 · Severity: medium · CVSS 4.6 · Published 2026-11-08

Vikunja is a collaborative task management and project planning application. An authenticated user with write access to a shared project can inject arbitrary CSS into task descriptions or comments that executes when other users view them, enabling phishing overlays or invisible tracking requests. The vulnerability affects all versions before 2.7.1.

Technologies: [Vikunja](https://junglewise.ai/threats/technologies/vikunja). Vendors: [Vikunja](https://junglewise.ai/threats/vendors/vikunja).

## Quick answers

**Is CVE-2026-123529 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123529 being exploited in the wild.

**How severe is CVE-2026-123529?** Medium severity, with a CVSS score of 4.6, published 8 November 2026.

**Which products and versions are affected?** Vikunja before 2.7.1.

**Is there a fix for CVE-2026-123529?** Yes: fixed in 2.7.1. Until then: Restrict project write access to trusted users only. Disable or limit the ability to create shared projects until the patch can be applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123529 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-123529?** Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.7.1

Restrict project write access to trusted users only. Disable or limit the ability to create shared projects until the patch can be applied.

## Technical details

The vulnerability is a stored CSS injection in the TipTap rich-text editor's CustomTableCell extension (editorExtensions.ts). The data-background-color attribute is interpolated unsanitized into an inline style string via raw string interpolation, allowing an attacker to inject CSS declarations by including semicolons and additional properties. The payload persists in the backend's stored HTML and executes in the browser of any user with read access, including project owners, without requiring user interaction beyond viewing.

## Affected products

- Vikunja Vikunja before 2.7.1

## Timeline

- 2026-10-22: disclosed
- 2026-11-08: advisory

## References

- [https://github.com/go-vikunja/vikunja/security/advisories/GHSA-p23m-cq25-pc4j](https://github.com/go-vikunja/vikunja/security/advisories/GHSA-p23m-cq25-pc4j)
- [https://www.vulncheck.com/advisories/vikunja-before-2.7.1-stored-css-injection-via-tiptap-table-cell-data-background-color](https://www.vulncheck.com/advisories/vikunja-before-2.7.1-stored-css-injection-via-tiptap-table-cell-data-background-color)

## Related threats

- [Vikunja denial of service via pagination bypass in API v1](https://junglewise.ai/threats/cve-2026-123531-vikunja-from-1-0-0-before-2-7-1-contains-an-uncontrolled)
- [Vikunja missing authentication in TOTP enrollment](https://junglewise.ai/threats/cve-2026-123530-vikunja-before-2-7-1-contains-a-missing-authentication)
- [Vikunja insufficient session expiration in HTTP token middleware](https://junglewise.ai/threats/cve-2026-123528-vikunja-before-2-7-1-contains-an-insufficient-session-expiration)
- [Vikunja API token authorization bypass in v1/v2 collision](https://junglewise.ai/threats/cve-2026-123527-vikunja-from-2-4-0-before-2-7-1-contains-an-authorization-bypass)
- [Vikunja mass assignment in team external_id field](https://junglewise.ai/threats/cve-2026-123526-vikunja-before-2-7-1-contains-a-mass-assignment-vulnerability)