PT-2026-27443 · Electron+1 · Electron+1

Highkolaente · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-33335

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.21.0 through 2.1.9

Description Vikunja is a self-hosted task management platform. Versions from 0.21.0 up to, but not including, 2.2.0 improperly handle URLs passed from window.open() calls to shell.openExternal() within the Desktop Electron wrapper. Specifically, there is a lack of validation or allowlisting of protocols. This allows an attacker to leverage links with target=" blank" or similar mechanisms within user-generated content to execute arbitrary URI schemes. This could lead to the invocation of local applications, opening of local files, or triggering of custom protocol handlers on the victim’s operating system. The shell.openExternal() function is used to open URLs in the user's default browser or associated application. The window.open() function is used to open a new browser window or tab.

Recommendations Update to Vikunja version 2.2.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-939

Related Identifiers

CVE-2026-33335

GHSA-6Q44-85GC-CJVF

Affected Products

Electron

Vikunja

References · 6

• 🔥 https://github.com/go-vikunja/vikunja/security/advisories/GHSA-6q44-85gc-cjvf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33335.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-33335 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33335 · Security Note
• https://twitter.com/CVEnew/status/2036505774684622934 · Twitter Post
• https://vikunja.io/changelog/vikunja-v2.2.0-was-released · Note