Vikunja project titles can hijack its coding agent

A prompt injection flaw in Vikunja's veans coding agent lets project members with write access feed instructions straight into the agent's authoritative instruction block, according to an entry published on the US National Vulnerability Database on 8 November 2026. The issue affects versions of veans before 2.7.1 and is tracked as CVE-2026-123498.

According to the NVD record, the problem is that project titles and task content are rendered verbatim inside the block of text that the coding agent treats as its own instructions. An attacker who can edit a project title or a task description can therefore write text that the agent reads not as data to work on, but as orders to follow.

The delivery path is the agent's prime hook, which the NVD entry says loads this content on SessionStart and PreCompact. In other words, the injected text is pulled in automatically when a session begins and again when the agent compacts its context, without the developer pasting anything or explicitly asking for the project data. The consequence described in the record is that the agent can be made to modify the developer's checkout, meaning the local copy of the source code they are working on, or to run commands.

The attacker in this scenario is not an anonymous outsider. The NVD entry specifies project members with write access, so the flaw matters most where a Vikunja project has contributors who are not fully trusted, or where an account belonging to a legitimate member has been taken over. Shared boards, client-facing projects and open teams are the obvious places where that write access is broad.

The fix is version 2.7.1. The NVD record describes the vulnerability as present in veans before that release, and points to a GitHub security advisory published by the go-vikunja project, GHSA-cvh3-hf56-g9xm, along with an advisory from VulnCheck covering the same issue under the description of prompt injection via project and task metadata.

No exploitation in the wild is described in the sources, and the record does not state when the flaw was introduced. The NVD entry carries a publication timestamp of 8 November 2026.

The pattern will be familiar to anyone tracking agent security. The vulnerability is not a memory bug or an authentication bypass. It is a failure to separate two kinds of text: the instructions a developer intends the agent to follow, and the content the agent is supposed to read, summarise or act upon. When both are concatenated into a single prompt, anyone who can write to the second category gains some control over the first. Task trackers are a particularly rich source of that attacker-controlled text, because their entire purpose is to collect free-form descriptions written by many people.

Teams running veans against a shared Vikunja instance should check their version against 2.7.1 and review who holds write access to projects the agent reads. The GitHub advisory from the go-vikunja project is the authoritative reference for affected versions and remediation.