code.vikunja.io/veans vulnerabilities

Latest code.vikunja.io/veans CVEs

Newest publication first

1. CVE-2026-123499 Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server

   Published 2026-11-08

   Medium·CVSS 6.0 EPSS 0.11%

   Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANS_TOKEN as a Bearer token, or l...

2. CVE-2026-123498 Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata

   Published 2026-11-08

   Low·CVSS 2.1 EPSS 0.15%

   Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction block. Attackers can craft Pro...

3. CVE-2026-123497 Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery

   Published 2026-11-08

   High·CVSS 7.6 EPSS 0.16%

   Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP co...

4. CVE-2026-123496 Vikunja veans before 2.7.1 Symlink Following in veans init

   Published 2026-11-08

   Medium·CVSS 4.8 EPSS 0.13%

   Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bash...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.