PT-2026-27444 · Vikunja+2 · Vikunja+2

Kolaente · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-33336

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.21.0 through 2.1.9

Description Vikunja Desktop, an Electron wrapper for the Vikunja task management platform, allows an attacker to execute arbitrary code on a victim's machine. This occurs because nodeIntegration is enabled in the main BrowserWindow without restrictions on same-window navigations. An attacker can craft a link within user-generated content, such as task descriptions or comments, that, when clicked by a victim, causes the BrowserWindow to navigate to an attacker-controlled origin. This allows JavaScript execution with full Node.js access, leading to arbitrary code execution. The issue stems from the combination of nodeIntegration: true and the absence of will-navigate or will-redirect handlers on the webContents. The vulnerability does not require a cross-site scripting (XSS) flaw; a standard, sanitized hyperlink is sufficient for exploitation.

Recommendations Vikunja versions 0.21.0 through 2.1.9 are affected. Update to version 2.2.0 or later to resolve this issue.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-33336

GHSA-83W9-9JF6-88VF

Affected Products

Electron

Vikunja

Vikunja Desktop

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33336.json · Exploit
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-83w9-9jf6-88vf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33336 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33336 · Vendor Advisory
• https://twitter.com/threatcluster/status/2036563897600131221 · Twitter Post
• https://vikunja.io/changelog/vikunja-v2.2.0-was-released · Note
• https://twitter.com/CVEnew/status/2036505773786931298 · Twitter Post