Vikunja EUVD-2026-14907

This vulnerability represents critical real-world risk despite the absence of a published CVSS score and EPSS data. The attack vector is network-based (XSS in web frontend), complexity is low (standard DOM-based XSS techniques apply), and no privileges are required—an unauthenticated attacker can often trigger XSS. The technical impact is catastrophic: remote code execution with the privileges of the Electron process user. The vulnerability is not listed in the CISA KEV catalog based on available data, but the presence of a GitHub security advisory (GHSA-xh67-63q3-hf7g) and fixed version (2.2.0) indicates active awareness in the security community. Exploitation is highly automatable—any XSS payload can be weaponized instantly into RCE without additional steps. This is not a high-CVSS-but-low-real-risk issue; it is a genuine priority because it turns a class of web vulnerabilities (XSS) into full system compromise. The fact that a patch has been released suggests the vendor recognized the severity.

An attacker discovers or crafts an XSS vulnerability in the Vikunja web frontend—for example, stored XSS in task descriptions or user comments. When a victim running Vikunja Desktop version 0.21.0 to 2.1.x loads a malicious task, the attacker's JavaScript payload executes in the Electron renderer with nodeIntegration enabled. The payload uses Node.js APIs like require('child_process').exec() to spawn a shell command, stealing sensitive files, installing malware, or establishing a reverse shell on the victim's machine. No user interaction beyond viewing the compromised content is required, and the attack chain is completely automated and reliably exploitable without special privileges.