Vulnerability · Published Mar 24, 2026 · Assigned by GitHub_M

CVE-2026-33334Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration

Medium 6.5

In plain English

A medium-severity code injection in vikunja from go-vikunja. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 4.0)6.5Medium

Exploit odds (30 days)0.4%top 65.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables `nodeIntegration` in the renderer process without `contextIsolation` or `sandbox`. This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected scripts gain access to Node.js APIs. Version 2.2.0 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
go-vikunja	vikunja	>= 0.21.0, < 2.2.0

Weakness: CWE-94, CWE-269 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

References

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xh67-63q3-hf7g x_refsource_CONFIRM
https://vikunja.io/changelog/vikunja-v2.2.0-was-released x_refsource_MISC