CVE-2026-33334

CRITICAL

9.6

Descripcion

Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables `nodeIntegration` in the renderer process without `contextIsolation` or `sandbox`. This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected scripts gain access to Node.js APIs. Version 2.2.0 fixes the issue.

Detalles CVE

Puntuacion CVSS v3.19.6

SeveridadCRITICAL

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado3/24/2026

Ultima modificacion3/27/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

vikunja:vikunja

Debilidades (CWE)

CWE-94CWE-269CWE-79

Referencias

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xh67-63q3-hf7g(security-advisories@github.com)

https://vikunja.io/changelog/vikunja-v2.2.0-was-released(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.