Which versions of Vikunja are affected by CVE-2026-33335?

Organizations using version 0.21.0 and should be aware of moderate risk from CVE-2026-33335 rated CVSS 6.4. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-33335?

Within 30 days: Identify affected systems running version 0.21.0 and and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Vikunja CVE-2026-33335

Q: What is the CVSS score of CVE-2026-33335?

CVE-2026-33335 has a CVSS 4.0 base score of 6.4 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14909 MEDIUM

Improper Authorization in Handler for Custom URL Scheme (CWE-939)

2026-03-24 GitHub_M

Information Disclosure Vikunja

6.4

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.4 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.2.0

EUVD ID Assigned

Mar 24, 2026 - 15:45 euvd

EUVD-2026-14909

Analysis Generated

Mar 24, 2026 - 15:45 vuln.today

CVE Published

Mar 24, 2026 - 15:07 nvd

MEDIUM 6.4

DescriptionGitHub Advisory

Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper passes URLs from window.open() calls directly to shell.openExternal() without any validation or protocol allowlisting. An attacker who can place a link with target="_blank" (or that otherwise triggers window.open) in user-generated content can cause the victim's operating system to open arbitrary URI schemes, invoking local applications, opening local files, or triggering custom protocol handlers. Version 2.2.0 patches the issue.

AnalysisAI

The Vikunja Desktop Electron application fails to validate or allowlist URI schemes before passing URLs from window.open() calls to shell.openExternal(), allowing attackers to invoke arbitrary local applications, open files, or trigger custom protocol handlers. Vikunja versions 0.21.0 through 2.1.x are affected, with the vulnerability patched in version 2.2.0. An attacker who can inject links with target="_blank" into user-generated content can exploit this to execute malicious actions on the victim's operating system without user awareness or explicit consent.

Technical ContextAI

The vulnerability exists in the Vikunja Desktop Electron wrapper (CPE: cpe:2.3:a:go-vikunja:vikunja). Electron's shell.openExternal() API is designed to open URLs and URI schemes using the operating system's default handlers. The root cause is classified under CWE-939 (Improper Authorization in Other Contexts), more specifically a failure to implement protocol allowlisting or URI validation before invoking system-level URI handlers. When a web page running within Electron calls window.open() with an attacker-controlled URL, the wrapper directly passes this to shell.openExternal() without sanitization, causing the OS to honor dangerous URI schemes such as file://, custom protocol handlers, or application-launching schemes (e.g., ms-settings:, apt:, etc.). This is a classic instance of inadequate trust boundary enforcement between the web context and the native OS layer.

RemediationAI

Immediately upgrade the Vikunja Desktop application to version 2.2.0 or later; this is the primary and complete remediation. Users unable to upgrade immediately should disable or restrict Electron's preload/context isolation settings if possible (consult Vikunja documentation), or avoid opening untrusted content (tasks, comments, descriptions) from external sources until patching is complete. Administrators distributing Vikunja Desktop should prioritize deployment of v2.2.0 via their software distribution mechanism. For organizations using the self-hosted web version, no action is required; the vulnerability is confined to the Electron wrapper. Monitor the GitHub advisory at https://github.com/go-vikunja/vikunja/security/advisories/GHSA-6q44-85gc-cjvf for any post-patch updates or additional guidance.