PT-2026-7716 · Vikunja · Vikunja

Supercoolspy · Published 2026-02-11 · Updated 2026-03-03 · CVE-2026-25935

Positive Technologies · (AI Summary)

CVSS v4.0

8.6

High

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 1.1.0

Description Vikunja, a todo-app, contains a cross-site scripting (XSS) issue in the task preview mechanism. The TaskGlanceTooltip.vue component creates a temporary div and sets its innerHtml to the task description without proper escaping. This allows a malicious user to create a task with a crafted description containing unescaped HTML, which can execute arbitrary JavaScript code when another user hovers over the task. The vulnerable code is located at line 118 of TaskGlanceTooltip.vue. The issue can be triggered by updating a task description via the API with malicious HTML, sharing the project, and having a user view the task. The innerHtml property is directly set with the unescaped description.

Recommendations Versions prior to 1.1.0 should be updated to version 1.1.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

CVE-2026-25935

GHSA-M4G2-2Q66-VC9V

GO-2026-4480

SUSE-SU-2026:0757-1

Affected Products

Vikunja

References · 119

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25935.json · Exploit
• https://github.com/go-vikunja/vikunja/commit/dd0b82f00a8c9ded1c19a1e643a197c514be6d37 · Patch
• https://osv.dev/vulnerability/CVE-2026-25935 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m4g2-2q66-vc9v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25935 · Security Note
• https://osv.dev/vulnerability/GO-2026-4480 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://github.com/go-vikunja/vikunja · Note
• https://github.com/go-vikunja/vikunja/releases/tag/v1.1.0 · Note
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m4g2-2q66-vc9v · Note
• https://suse.com/security/cve/CVE-2026-25791 · Note
• https://suse.com/security/cve/CVE-2026-25934 · Note
• https://suse.com/security/cve/CVE-2017-18909 · Note
• https://suse.com/security/cve/CVE-2026-25793 · Note
• https://suse.com/security/cve/CVE-2025-13821 · Note