Plattform
nodejs
Komponente
node.js
Behoben in
0.21.1
2.2.3
CVE-2026-33334 describes a critical Cross-Site Scripting (XSS) vulnerability within the Vikunja Desktop Electron wrapper. This flaw, present in versions 0.21.0 through 2.2.2, enables attackers to escalate XSS vulnerabilities in the Vikunja web frontend to full remote code execution on the victim's machine. The vulnerability stems from the lack of context isolation and sandboxing, granting injected scripts access to Node.js APIs. Version 2.2.0 addresses this issue.
The core issue lies in the Vikunja Desktop Electron wrapper's configuration, which enables nodeIntegration without contextIsolation or sandbox. This means any XSS vulnerability present or introduced in the Vikunja web frontend can be directly exploited to gain full remote code execution. An attacker could inject malicious JavaScript code through a vulnerable Vikunja web interface, and this code would then have access to Node.js APIs within the Electron environment. This grants the attacker the ability to read and write files, execute system commands, and potentially compromise the entire system. The blast radius extends to any sensitive data stored locally on the victim's machine, including credentials, configuration files, and personal information.
CVE-2026-33334 was publicly disclosed on March 24, 2026. No public proof-of-concept (PoC) code has been released at the time of writing, but the vulnerability's severity and the potential for remote code execution suggest a high likelihood of exploitation. The vulnerability is not currently listed on the CISA KEV catalog. Given the critical CVSS score and the ease of exploitation once a PoC is available, organizations should prioritize patching.
Users who rely on Vikunja Desktop for task management, particularly those running versions 0.21.0 through 2.2.2, are at significant risk. This includes individuals and organizations using Vikunja for personal or professional task tracking. Shared hosting environments where Vikunja Desktop is installed could expose multiple users to the vulnerability if the application is not properly secured.
• windows / supply-chain: Monitor Vikunja Desktop processes for unusual network activity or unexpected file modifications. Use Windows Defender to scan for suspicious files or registry keys associated with Vikunja.
Get-Process -Name VikunjaDesktop | Select-Object -ExpandProperty Path• linux / server: Monitor Vikunja Desktop application logs for signs of XSS attempts or unusual Node.js activity. Use lsof to identify open files and network connections associated with the Vikunja Desktop process.
lsof -p $(pidof VikunjaDesktop)• generic web: If Vikunja is accessible via a web interface, perform regular security scans for XSS vulnerabilities. Review access and error logs for suspicious requests or payloads.
grep -i 'script' /var/log/apache2/access.logdisclosure
patch
Exploit-Status
EPSS
0.14% (34% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2026-33334 is to immediately upgrade Vikunja Desktop Electron to version 2.2.0 or later. This version incorporates the necessary security enhancements to prevent the remote code execution vulnerability. If upgrading is not immediately feasible due to compatibility concerns or system downtime requirements, consider temporarily disabling the Vikunja Desktop Electron application to reduce the attack surface. While a WAF or proxy cannot directly mitigate this vulnerability, ensuring the Vikunja web frontend is hardened against XSS attacks is crucial. Regularly scan the Vikunja web frontend for XSS vulnerabilities and apply appropriate patches.
Aktualisieren Sie Vikunja Desktop auf Version 2.2.0 oder höher. Diese Version behebt die Schwachstelle, die Remote Code Execution über XSS ermöglicht.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2026-33334 is a critical Cross-Site Scripting (XSS) vulnerability in Vikunja Desktop versions 0.21.0–2.2.2 that allows for remote code execution.
You are affected if you are running Vikunja Desktop versions 0.21.0 through 2.2.2. Upgrade to 2.2.0 or later to resolve the issue.
Upgrade Vikunja Desktop to version 2.2.0 or later. If immediate upgrade is not possible, consider sandboxing the application.
There is currently no indication of active exploitation campaigns, but the vulnerability's nature makes it likely that exploitation will occur.
Refer to the official Vikunja project website and security advisories for the latest information and updates.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.