CVE-2026-123508
LOW
NVD
CVSS Score
3.1
Severity
LOW
Published
Nov 08, 2026
Vendor
unknown
Description
Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries shipped under a valid signature.