Vikunja releases before version 2.7.1 retrieve the xgo module and Docker image using mutable "latest" references during the mage build process. If an attacker compromises the upstream xgo module, the Docker registry, or the image itself, they can insert malicious code that will then be compiled into the Vikunja release binaries. Because the binaries are signed with a valid signature, users trusting the signature will inadvertently install and run code that may execute arbitrary actions on the host, compromising system integrity and potentially confidentiality.

The vulnerability affects all installations of Vikunja version 2.7.0 and earlier, as those builds use the vulnerable mage release targets. The product is identified as go‑vikunja:vikunja. Any deployment that performs a build of the release binaries with the unpinned xgo references is susceptible, regardless of operating system or deployment environment.

With a CVSS score of 2, the severity of the vulnerability is low. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating a modest but nonzero risk. Attackers would need to compromise the upstream xgo module, Docker image, or registry that the build process contacts; they would not need direct access to the target system. Therefore exploitation is contingent on a supply‑chain compromise, which, while possible, is relatively uncommon in most environments.