PT-2026-27443 · Electron+1 · Electron+1

Highkolaente · Publicado 2026-03-24 · Atualizado 2026-03-24 · CVE-2026-33335

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.21.0 through 2.1.9

Description Vikunja is a self-hosted task management platform. Versions from 0.21.0 up to, but not including, 2.2.0 improperly handle URLs passed from window.open() calls to shell.openExternal() within the Desktop Electron wrapper. Specifically, there is a lack of validation or allowlisting of protocols. This allows an attacker to leverage links with target=" blank" or similar mechanisms within user-generated content to execute arbitrary URI schemes. This could lead to the invocation of local applications, opening of local files, or triggering of custom protocol handlers on the victim’s operating system. The shell.openExternal() function is used to open URLs in the user's default browser or associated application. The window.open() function is used to open a new browser window or tab.

Recommendations Update to Vikunja version 2.2.0 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-939

Identificadores relacionados

CVE-2026-33335

GHSA-6Q44-85GC-CJVF

Produtos afetados

Electron

Vikunja

Referências · 6

• 🔥 https://github.com/go-vikunja/vikunja/security/advisories/GHSA-6q44-85gc-cjvf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33335.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-33335 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2036505774684622934 · Publicação no Twitter
• https://vikunja.io/changelog/vikunja-v2.2.0-was-released · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-33335 · Nota de Segurança