Vulnerability Details CVE-2026-33334
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables `nodeIntegration` in the renderer process without `contextIsolation` or `sandbox`. This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected scripts gain access to Node.js APIs. Version 2.2.0 fixes the issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 62.9%
CVSS Severity
CVSS v3 Score 9.6
References
Products affected by CVE-2026-33334
-
cpe:2.3:a:vikunja:vikunja:0.21.0
-
cpe:2.3:a:vikunja:vikunja:0.22.0
-
cpe:2.3:a:vikunja:vikunja:0.22.1
-
cpe:2.3:a:vikunja:vikunja:0.23.0
-
cpe:2.3:a:vikunja:vikunja:0.24.0
-
cpe:2.3:a:vikunja:vikunja:0.24.1
-
cpe:2.3:a:vikunja:vikunja:0.24.2
-
cpe:2.3:a:vikunja:vikunja:0.24.3
-
cpe:2.3:a:vikunja:vikunja:0.24.4
-
cpe:2.3:a:vikunja:vikunja:0.24.5
-
cpe:2.3:a:vikunja:vikunja:0.24.6
-
cpe:2.3:a:vikunja:vikunja:1.0.0
-
cpe:2.3:a:vikunja:vikunja:1.1.0
-
cpe:2.3:a:vikunja:vikunja:2.0.0
-
cpe:2.3:a:vikunja:vikunja:2.1.0