Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure

Vulnerability

Vikunja, an open-source task management platform, fails to sanitize SVG files uploaded as task attachments. SVG supports JavaScript execution through ` tags or event handlers like onload`. The application stores these files without validation, and when accessed via direct URL, they render inline under the application's origin, allowing embedded scripts to execute in the authenticated user's browser context [1][3].

Exploitation

An authenticated attacker can upload a malicious SVG containing JavaScript that accesses localStorage.getItem('token') to retrieve the authentication token. When another user (or the attacker themselves) opens the attachment URL, the script runs immediately, exposing the token. No additional user interaction is required beyond viewing the attachment [3].

Impact

Successful exploitation leads to account takeover, as the attacker can use the stolen token to perform authenticated actions on behalf of the victim. This could include privilege escalation if the victim has higher privileges [3].

Mitigation

The issue is patched in Vikunja version 2.0.0, which includes major security improvements to session authentication and SVG handling [2][4]. Users are urged to upgrade immediately.