PT-2026-27442 · Go Vikunja · Vikunja

Highkolaente · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-33334

Mitre

CVSS v4.0

6.5

Medium

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables nodeIntegration in the renderer process without contextIsolation or sandbox. This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected scripts gain access to Node.js APIs. Version 2.2.0 fixes the issue.

Fix

Code Injection

Improper Privilege Management

Weakness Enumeration

CWE-94

CWE-269

Related Identifiers

CVE-2026-33334

Affected Products

Vikunja

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-33334 · Security Note
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xh67-63q3-hf7g · Note
• https://vikunja.io/changelog/vikunja-v2.2.0-was-released · Note