CVE-2026-123508

3.1 LOWpublic exploit available

Published 2026-11-08 · Updated 2026-11-08

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries shipped under a valid signature.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

Weaknesses

CWE-494

Public exploit & PoC references

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-h8wj-3gwg-jjjg

All references

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-h8wj-3gwg-jjjg
https://www.vulncheck.com/advisories/vikunja-before-2.7.1-supply-chain-risk-via-unpinned-xgo-release-toolchain

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100265
UNSCOREDCVE-2026-102930PoC
HIGHCVE-2026-104657
UNSCOREDCVE-2026-104805
UNSCOREDCVE-2026-104809
HIGHCVE-2026-105036PoC
MEDIUMCVE-2026-105137PoC
HIGHCVE-2026-105295PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.