A prompt injection flaw in Vikunja veans allows authorized project members to insert crafted text into project titles or task content. When that text is rendered by the coding agent's authoritative instruction block, it can alter developer actions such as modifying the checkout path or executing arbitrary commands. This represents a compromise of both integrity and potential confidentiality by letting an attacker influence which code or environment is used in a session.

Vikunja (go‑vikunja:vikunja) versions earlier than 2.7.1 are affected. The vulnerability is present in all releases of the veans component before the 2.7.1 fix, regardless of deployment environment.

The CVSS score of 2.1 indicates low overall severity but the attack requires write access to project metadata, implying the attacker must already have some level of internal access. With no EPSS data, the probability of exploitation is unknown; the vulnerability is not listed in CISA KEV. If compromised, the coding agent could carry out unintended actions, affecting the developer’s workflow and potentially exposing sensitive data. Given the limited scope, the risk is considered low to moderate, but the impact can be severe in environments where the coding agent has elevated privileges.