VYPR
← All advisories
Critical severity9.6NVD Advisory· Published Mar 24, 2026· Updated Jun 17, 2026

CVE-2026-33334

CVE-2026-33334

Description

Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables nodeIntegration in the renderer process without contextIsolation or sandbox. This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected scripts gain access to Node.js APIs. Version 2.2.0 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Go Vikunja/Vikunjacpe-rescue
    Range: >= 0.21.0, < 2.2.0
  • Vikunja/Vikunjallm-fuzzy2 versions
    0.21.0 <= version < 2.2.0+ 1 more
    • (no CPE)range: 0.21.0 <= version < 2.2.0
    • cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*range: >=0.21.0,<2.2.2

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.