Low severity3.1NVD Advisory· Published Nov 8, 2026· Updated Nov 8, 2026
CVE-2026-123508
CVE-2026-123508
Description
Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries shipped under a valid signature.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <2.7.1
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.