In short
- CVE-2026-25935 is a MEDIUM (CVSS 5.4) vulnerability affecting code.vikunja.io/api, vikunja (vikunja).
- Chance of exploitation in the next 30 days (EPSS): 0.26%, higher than 18.1% of all vulnerabilities.
- Fix: update to 1.1.0 or later.
Description
Summary
The task preview component creates a unparented div. The div's innerHtml is set to the unescaped description of the task
Details
In the TaskGlanceTooltip.vue it temporarily creates a div and sets the innerHtml to the description here. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover.
PoC
- Create a project
- Create a task with any description
- Use the api to update the task with a description containing unescaped HTML (ex:
<img src=x onerror="alert(localStorage.getItem('token'))">
- Share the project with any permission level
- Send malicious project to user and ask them to view task
Impact
Any user on an instance can cause an XSS on another
NVD description
Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover. This vulnerability is fixed in 1.1.0.
More vulnerabilities in code.vikunja.io/api
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free