CVE-2026-33335

HIGH

8.0

Descripcion

Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper passes URLs from `window.open()` calls directly to `shell.openExternal()` without any validation or protocol allowlisting. An attacker who can place a link with `target="_blank"` (or that otherwise triggers `window.open`) in user-generated content can cause the victim's operating system to open arbitrary URI schemes, invoking local applications, opening local files, or triggering custom protocol handlers. Version 2.2.0 patches the issue.

Detalles CVE

Puntuacion CVSS v3.18.0

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioREQUIRED

Publicado3/24/2026

Ultima modificacion3/27/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

vikunja:vikunja

Debilidades (CWE)

CWE-939

Referencias

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-6q44-85gc-cjvf(security-advisories@github.com)

https://vikunja.io/changelog/vikunja-v2.2.0-was-released(security-advisories@github.com)

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-6q44-85gc-cjvf(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.