Vikunja versions from 2.2.0 through 2.7.0 contain an HTML injection flaw where raw display names and task or project titles are interpolated into email anchors without sanitization. An attacker who is an authenticated user can craft titles or display names that close the anchor tag and insert malicious phishing links into task‑comment and task‑mention notification emails sent to project members. This enables social engineering attacks that could lead to credential compromise or other exploitation once a recipient follows the injected link. The weakness corresponds to CWE‑79, typical of improper input validation leading to cross‑site scripting style injection.

The affected product is Vikunja v2.2.0 through v2.7.0, inclusive. Users running any of these releases are susceptible; upgrades to v2.7.1 or later resolve the issue.

The CVSS score of 5.1 indicates moderate overall risk. No EPSS data is published, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user who can set or modify task or project titles or display names. Once such a user delivers a malicious title, all members of the affected project will receive notification emails containing phishing links, making the attack potential high within the project’s user base. The likelihood of exploitation is constrained to organizations that use the vulnerable Vikunja releases and allow users to edit titles or display names freely.