Vikunja's veans coding-agent hook pasted project titles and task text into the agent's authoritative instructions, letting any project writer steer it (CVE-2026-123498, fixed in 2.7.1)
- Update veans to 2.7.1.
- For any agent hook you write: put tracker or ticket text in a clearly marked untrusted section, never in system or project instructions.
Sources: GitHub Advisory: GHSA-3v4w-4754-gmfj · Vikunja advisory GHSA-cvh3-hf56-g9xm