CVE-2026-25935
Vikunja Vulnerable to XSS Via Task Preview
Impact
### Summary The task preview component creates a unparented div. The div's `innerHtml` is set to the unescaped description of the task ### Details In the `TaskGlanceTooltip.vue` it temporarily creates a div and sets the `innerHtml` to the description [here](https://github.com/go-vikunja/vikunja/blob/cdca79032526966cb248b72bddcf2a0f888c8a8f/frontend/src/components/tasks/partials/TaskGlanceTooltip.vue#L118). Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover. ### PoC 1. Create a project 2. Create a task with any description 3. Use the api to update the task with a description containing unescaped HTML (ex: `<img src=x onerror="alert(localStorage.getItem('token'))">` 4. Share the project with any permission level 5. Send malicious project to user and ask them to view task ### Impact Any user on an instance can cause an XSS on another
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | code.vikunja.io/api | <= 0.24.6 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vikunja | Vikunja | before 1.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/go-vikunja/vikunja/commit/dd0b82f00a8c9ded1c19a1e643a197c514be6d37
- https://github.com/go-vikunja/vikunja/releases/tag/v1.1.0
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m4g2-2q66-vc9v
- https://vikunja.io/changelog/vikunja-v1.1.0-was-released
- https://github.com/advisories/GHSA-m4g2-2q66-vc9v
- https://nvd.nist.gov/vuln/detail/CVE-2026-25935