CVE-2026-33335 Details
Description
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper passes URLs from `window.open()` calls directly to `shell.openExternal()` without any validation or protocol allowlisting. An attacker who can place a link with `target="_blank"` (or that otherwise triggers `window.open`) in user-generated content can cause the victim's operating system to open arbitrary URI schemes, invoking local applications, opening local files, or triggering custom protocol handlers. Version 2.2.0 patches the issue.
A vulnerability in the Vikunja Desktop Electron wrapper, present in versions 0.21.0 prior to 2.2.0, allows for the unvalidated opening of URLs through the operating system's default application handlers. This issue arises because the application passes URLs from 'window.open()' calls directly to 'shell.openExternal()' without any validation or allowlisting of protocols. As a result, an attacker can exploit this by inserting links that trigger 'window.open' in user-generated content, potentially leading to the execution of local applications, opening of files, or activation of custom protocol handlers.
Users are advised to update Vikunja Desktop to version 2.2.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-6q44-85gc-cjvf | CISA-ADP | ExploitVendor Advisory |
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-6q44-85gc-cjvf | [email protected] | ExploitVendor Advisory |
| https://vikunja.io/changelog/vikunja-v2.2.0-was-released | [email protected] | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-939 | Improper Authorization in Handler for Custom URL Scheme | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vikunja vikunja | >= 0.21.0, < 2.2.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 27, 2026 | Initial Analysis | [email protected] |
| Mar 25, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | New CVE Received | [email protected] |