CVE-2026-33334 MEDIUM

CVE-2026-33334: Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration

Vendor Go-Vikunja
Product vikunja
Weakness CWE-94 · Code injection
Published March 24, 2026
Last update March 24, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

What the vulnerability does

01Description

Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables `nodeIntegration` in the renderer process without `contextIsolation` or `sandbox`. This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected scripts gain access to Node.js APIs. Version 2.2.0 fixes the issue.

Key dates

02Disclosure timeline

March 24, 2026 CVE published
March 24, 2026 Record updated