Kurz gesagt
- CVE-2026-25935 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in code.vikunja.io/api, vikunja (vikunja).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.26%, höher als bei 18.1% aller Schwachstellen.
- Abhilfe: auf 1.1.0 oder neuer aktualisieren.
Description
Summary
The task preview component creates a unparented div. The div's innerHtml is set to the unescaped description of the task
Details
In the TaskGlanceTooltip.vue it temporarily creates a div and sets the innerHtml to the description here. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover.
PoC
- Create a project
- Create a task with any description
- Use the api to update the task with a description containing unescaped HTML (ex:
<img src=x onerror="alert(localStorage.getItem('token'))">
- Share the project with any permission level
- Send malicious project to user and ask them to view task
Impact
Any user on an instance can cause an XSS on another
NVD description
Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover. This vulnerability is fixed in 1.1.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free