Is CVE-2026-35600 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35600 being exploited in the wild.

How severe is CVE-2026-35600?

Medium severity, with a CVSS score of 5.4, published 10 April 2026.

Which products and versions are affected?

code.vikunja.io/api (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.3.0.

Is there a fix for CVE-2026-35600?

Yes. code.vikunja.io/api (Go): upgrade to 2.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35600 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-35600?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35600: Vikunja Markdown injection in email notifications

CVE-2026-35600 · Severity: medium · CVSS 5.4 · Published 2026-04-10

Vikunja is an open-source to-do list application. A vulnerability in how it handles task titles allows an attacker to inject malicious links or tracking pixels into automated email notifications sent to other users. This could be used for phishing attacks or to track when a user opens their email, potentially compromising user privacy or leading to account takeover if a user clicks a deceptive link.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is CVE-2026-35600 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35600 being exploited in the wild.
How severe is CVE-2026-35600?: Medium severity, with a CVSS score of 5.4, published 10 April 2026.
Which products and versions are affected?: code.vikunja.io/api (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.3.0.
Is there a fix for CVE-2026-35600?: Yes. code.vikunja.io/api (Go): upgrade to 2.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35600 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-35600?: Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.vikunja.io/api (Go): upgrade to 2.3.0 or later
```
go get code.vikunja.io/api@v2.3.0
```

Technical details

The vulnerability exists in the notification generation logic (specifically `pkg/models/notifications.go`), where task titles are concatenated directly into Markdown link syntax `[TITLE](URL)`. An attacker with project write access can craft a task title containing Markdown control characters (like `]` and `[`) to break out of the intended link and inject arbitrary Markdown. When the backend renders this Markdown to HTML using the `goldmark` library and sanitizes it with `bluemonday`, the resulting HTML retains injected `<a>` and `<img>` tags. This allows for the insertion of phishing links and tracking pixels into legitimate system-generated emails. The issue is fixed in version 2.3.0.

Affected products

go-vikunja Vikunja <= 2.2.2

Identifiers

CVE-2026-35600
GHSA-45q4-x4r9-8fqj
GO-2026-5111

Timeline

2026-04-09: disclosed
2026-04-10: advisory
2026-04-10: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.