Vikunja 'veans' coding-agent prompt injection via project title / task content (CVE-2026-123498)

CVE-2026-123498 (CVSS 3.1 3.7 / CVSS 4.0 2.1) — prompt injection in Vikunja veans before 2.7.1: project members with write access inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction block. Verified via NVD REST (published 2026-11-08) and the GitHub advisory.

A concrete instance of user-controlled project fields becoming an indirect prompt-injection entry point into a coding agent's authoritative instructions — the same coding-agent config/SessionStart injection class defenders keep seeing. Low severity and niche reach, but a real, catalogued AI-ecosystem case worth keeping on the radar.

A project member with write access sets a ProjectTitle or task description that is rendered verbatim inside the coding agent's authoritative instruction block; the 'prime' hook loads it on SessionStart and PreCompact, so the agent can modify the developer's checkout or run commands.

Vikunja veans before 2.7.1 (go-vikunja/veans)

Upgrade veans to 2.7.1 or later; restrict who can write project titles/task content; treat authored text that lands in an agent's authoritative instruction block as untrusted.