CVE-2026-123508 Details
Description
Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries shipped under a valid signature.
A supply chain vulnerability has been identified in Vikunja versions prior to 2.7.1. The issue arises from the mage release targets, which fetch the xgo module and Docker image using mutable 'latest' references. This vulnerability allows attackers who compromise the upstream xgo module, image, or registry to inject malicious code into release binaries, which are then distributed under a valid signature.
To address this vulnerability, pin the xgo module version and pass the specific image digest reference when using the xgo tool in the release process. This ensures that the Docker image used is not subject to change and maintains the integrity of the build.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-494 | Download of Code Without Integrity Check | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vikunja | <= 2.7.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | New CVE Received | [email protected] |