CVE-2026-33334

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-33334
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables `nodeIntegration` in the renderer process without `contextIsolation` or `sandbox`. This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected scripts gain access to Node.js APIs. Version 2.2.0 fixes the issue.

9.6 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xh67-63q3-hf7g Vendor Advisory
https://vikunja.io/changelog/vikunja-v2.2.0-was-released Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*
History

27 Mar 2026, 16:21

Type Values Removed Values Added
CWE CWE-79
CPE cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*
First Time Vikunja
Vikunja vikunja
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.6
Summary
  • (es) Vikunja es una plataforma de gestión de tareas de código abierto autoalojada. A partir de la versión 0.21.0 y antes de la versión 2.2.0, el wrapper de Electron de Vikunja Desktop habilita 'nodeIntegration' en el proceso de renderizado sin 'contextIsolation' ni sandbox. Esto significa que cualquier vulnerabilidad de cross-site scripting (XSS) en el frontend web de Vikunja -- presente o futura -- escala automáticamente a ejecución remota de código completa en la máquina de la víctima, ya que los scripts inyectados obtienen acceso a las API de Node.js. La versión 2.2.0 corrige el problema.
References () https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xh67-63q3-hf7g - () https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xh67-63q3-hf7g - Vendor Advisory
References () https://vikunja.io/changelog/vikunja-v2.2.0-was-released - () https://vikunja.io/changelog/vikunja-v2.2.0-was-released - Release Notes

24 Mar 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-24 16:16

Updated : 2026-03-27 16:21

NVD link : CVE-2026-33334

Mitre link : CVE-2026-33334

CVE.ORG link : CVE-2026-33334

JSON object : View

Products Affected

vikunja

  • vikunja
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-269

Improper Privilege Management

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')