HarborGuard / CVE
Back to search
HIGHCVE-2026-25935Published Modified CNA GitHub_M

CVE-2026-25935: Vikunja Affected by XSS Via Task Preview

Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover. This vulnerability is fixed in 1.1.0.

Metrics

CVSS v4.0
8.6
Severity
HIGH
Fixed in
—
Affected Products
1
Affected packages
  • go-vikunja / vikunja
    < 1.1.0
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References