CVE-2026-33334 Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration
Vikunja Desktop's insecure Electron configuration allows any frontend XSS to escalate to remote code execution via Node.js APIs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-33334?
CVE-2026-33334 is a medium-severity code injection vulnerability in go-vikunja vikunja, published on 24 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables `nodeIntegration` in the renderer process without `contextIsolation` or `sandbox`. This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected scripts gain access to Node.js APIs. Version 2.2.0 fixes the issue.
Which versions are affected by CVE-2026-33334?
It affects 1 product.
Products include Vikunja Vikunja.
How do I fix CVE-2026-33334?
No fix has been published for CVE-2026-33334 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-33334 being exploited?
There is no known exploitation of CVE-2026-33334 in the wild and no public exploit code.
Other vulnerabilities in go-vikunja vikunja
- CVE-2026-28268 Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse
- CVE-2026-27575 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change
- CVE-2026-25935 Vikunja Affected by XSS Via Task Preview
- CVE-2026-35595 Vikunja Affected by Privilege Escalation via Project Reparenting
- CVE-2026-33316 Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement
Sources
Also known as GHSA-xh67-63q3-hf7g.