En bref
- CVE-2026-25935 est une vulnérabilité MOYENNE (CVSS 5.4) touchant code.vikunja.io/api, vikunja (vikunja).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.26%, plus élevée que 18.1% des vulnérabilités.
- Correctif : mettre à jour vers 1.1.0 ou plus récent.
Description
Summary
The task preview component creates a unparented div. The div's innerHtml is set to the unescaped description of the task
Details
In the TaskGlanceTooltip.vue it temporarily creates a div and sets the innerHtml to the description here. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover.
PoC
- Create a project
- Create a task with any description
- Use the api to update the task with a description containing unescaped HTML (ex:
<img src=x onerror="alert(localStorage.getItem('token'))">
- Share the project with any permission level
- Send malicious project to user and ask them to view task
Impact
Any user on an instance can cause an XSS on another
NVD description
Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover. This vulnerability is fixed in 1.1.0.
Autres vulnérabilités de code.vikunja.io/api
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free