GitHub Advisoryadvisory · Go

GHSA-m4g2-2q66-vc9v Vikunja Vulnerable to XSS Via Task Preview

HIGH Published 2026-02-11 Modified 2026-02-11 Official page ↗
Aliases
CVE-2026-25935
Ecosystem
Go
Packages
code.vikunja.io/api
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-79, CWE-80
Reviewed
2026-02-11

Affected packages

• Go code.vikunja.io/api: <= 0.24.6 (no fix yet)

Description

Summary The task preview component creates a unparented div. The div's `innerHtml` is set to the unescaped description of the task Details In the `TaskGlanceTooltip.vue` it temporarily creates a div and sets the `innerHtml` to the description here. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover. PoC 1. Create a project 2. Create a task with any description 3. Use the api to update the task with a description containing unescaped HTML (ex: `` 4. Share the project with any permission level 5. Send malicious project to user and ask them to view task Impact Any user on an instance can cause an XSS on another

Related

Alias · CVE (1)

  • CVE-2026-25935 Vikunja is a todo-app to organize your life. vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References