CVE-2026-33334
Vikunja is an open-source self-hosted task management platform.
Published Mar 24, 2026 · updated Jun 17, 2026 · vikunja vikunja
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables in the renderer process without or . This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected scripts gain access to Node.js APIs. Version 2.2.0 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 24, 2026 · NIST NVD
Detected
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables in the renderer process without or . This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected
Jun 17, 2026 · NIST NVD
Updated
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables in the renderer process without or . This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected
Affected
- cpe vikunja/vikunjaversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33334
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33334
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables in the renderer process without or . This means any cross-site scripti
nvd.nist.gov