Read the docs
TI-2026-25745 Aliases CVE-2026-33335

Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal

Priority MEDIUM 62CWE-939Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper passes URLs from `window.open()` calls directly to `shell.openExternal()` without any validation or protocol allowlisting. An attacker who can place a link with `target="_blank"` (or that otherwise triggers `window.open`) in user-generated content can cause the victim's operating system to open arbitrary URI schemes, invoking local applications, opening local files, or triggering custom protocol handlers. Version 2.2.0 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed vikunja (go-vikunja): 2.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
go-vikunjavikunja0.21.0 to before 2.2.02.2.0Patch availableCNA
  • vikunja Vendorgo-vikunja Affected 0.21.0 to before 2.2.0 Fixed in 2.2.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*0.21.0 to before 2.2.2Vulnerablego-vikunja
  • cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* Versions 0.21.0 to before 2.2.2 Vulnerable ·go-vikunja

Remediation

  • Fix · CNA vikunja (go-vikunja) Fixed in 2.2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33335

References

Exploit 1

Other 1

  • TI-2026-21967 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change CVSS 3.1CRITICAL 9.1
  • TI-2026-26971 Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path CVSS 3.1CRITICAL 9.1
  • TI-2026-26060 Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation CVSS 3.1HIGH 7.5
  • TI-2026-20965 Vikunja Affected by XSS Via Task Preview CVSS 4.0HIGH 8.6
  • TI-2026-27698 Vikunja Affected by Privilege Escalation via Project Reparenting CVSS 3.1HIGH 8.3
  • TI-2026-25727 Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement CVSS 3.1HIGH 8.1
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences