Vikunja EUVD-2026-14909

While a formal CVSS score and EPSS probability are not provided, the risk is substantial based on available signals. The attack vector is network-based and requires no privileges (attacker only needs to inject a link into content the victim views), making it trivially exploitable. The complexity is low—any user-generated content field (comments, task descriptions, notes) can carry the malicious payload. The technical impact is severe: arbitrary code execution or file access is possible depending on the OS and installed applications. The vulnerability affects the Desktop application, which is typically run by end-users on workstations where local file access and application invocation pose significant risk (information disclosure, privilege escalation, lateral movement). The GitHub advisory and changelog reference indicate vendor awareness and a released patch (v2.2.0), reducing urgency for vendors but creating a window of exposure for unpatched deployments. The lack of a public POC does not diminish exploitability—the attack surface is enormous (any website or plugin that injects HTML with target="_blank" links). This is a high-priority vulnerability for all desktop users; the real-world impact depends on what trusted applications and files are accessible on each victim's system.

A malicious user embeds a link such as <a href="file:///etc/passwd" target="_blank">Click for details</a> or <a href="ms-settings:appsfeatures" target="_blank">Update</a> in a Vikunja task description or comment. When a victim using Vikunja Desktop (v0.21.0–v2.1.x) clicks the link or the page auto-triggers window.open(), the Electron wrapper passes the URI directly to the OS without validation, causing the victim's file manager to open a sensitive file or a system settings panel to launch. On Linux, an attacker could craft a link like apt:package-name to trigger package installation or xdg-open with a local path to exfiltrate file contents. The attack requires only network-level injection of HTML and exploits the implicit trust users place in content displayed within the application, making it practical and difficult to detect without analyzing page sources.