Unrated severityNVD Advisory· Published Mar 24, 2026· Updated Mar 24, 2026
Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration
CVE-2026-33334
Description
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables nodeIntegration in the renderer process without contextIsolation or sandbox. This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected scripts gain access to Node.js APIs. Version 2.2.0 fixes the issue.
Affected products
2- go-vikunja/vikunjav5Range: >= 0.21.0, < 2.2.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- github.com/go-vikunja/vikunja/security/advisories/GHSA-xh67-63q3-hf7gmitrex_refsource_CONFIRM
- vikunja.io/changelog/vikunja-v2.2.0-was-releasedmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.