CVE-2026-33334

Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration

State: Published
Severity: 6.5 Medium
Published: Mar 24, 2026
Updated: Mar 24, 2026
Reserved: Mar 18, 2026

Description

Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables `nodeIntegration` in the renderer process without `contextIsolation` or `sandbox`. This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected scripts gain access to Node.js APIs. Version 2.2.0 fixes the issue.

Scores

CVSS	Score	Vector	Source
4.0	6.5 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H	GitHub_M

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-269 Improper Privilege Management

Affected Products

Product	Versions
vikunjago-vikunja	>= 0.21.0, < 2.2.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.