CVE-2026-33334 Details
Description
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables `nodeIntegration` in the renderer process without `contextIsolation` or `sandbox`. This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected scripts gain access to Node.js APIs. Version 2.2.0 fixes the issue.
A vulnerability in the Vikunja Desktop Electron wrapper, present in versions 0.21.0 prior to 2.2.0, allows for remote code execution. This issue arises because the Electron wrapper enables node integration in the renderer process without proper context isolation or sandboxing. As a result, any cross-site scripting (XSS) vulnerability in the Vikunja web frontend can be exploited to execute arbitrary code on the user's machine, with the injected scripts gaining access to Node.js APIs. The vulnerability is rooted in the 'BrowserWindow' being created with 'nodeIntegration' set to true, while lacking essential hardening options such as 'contextIsolation', 'sandbox', and 'webviewTag'.
Users can upgrade to Vikunja version 2.2.0 or later, where this vulnerability has been fixed. Instructions for updating are available in the Vikunja documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xh67-63q3-hf7g | [email protected] | Vendor Advisory |
| https://vikunja.io/changelog/vikunja-v2.2.0-was-released | [email protected] | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-269 | Improper Privilege Management | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vikunja vikunja | >= 0.21.0, < 2.2.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 27, 2026 | Initial Analysis | [email protected] |
| Mar 24, 2026 | New CVE Received | [email protected] |