CVE-2026-25935: Vikunja Affected by XSS Via Task Preview
Summary The task preview component creates a unparented div. The div's innerHtml is set to the unescaped description of the task
Details In the TaskGlanceTooltip.vue it temporarily creates a div and sets the innerHtml to the description here. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover.
PoC 1. Create a project 2. Create a task with any description 3. Use the api to update the task with a description containing unescaped HTML (ex: <img src=x onerror="alert(localStorage.getItem('token'))"> 4. Share the project with any permission level 5. Send malicious project to user and ask them to view task
Impact Any user on an instance can cause an XSS on another
Other sources
Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover. This vulnerability is fixed in 1.1.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25935?
CVE-2026-25935 has a medium severity rating due to the potential for cross-site scripting (XSS) vulnerabilities.
How do I fix CVE-2026-25935?
To fix CVE-2026-25935, update the affected package to version 0.24.7 or later.
What kind of vulnerability is CVE-2026-25935?
CVE-2026-25935 is a cross-site scripting (XSS) vulnerability that results from unescaped HTML being injected into the DOM.
Which software versions are affected by CVE-2026-25935?
CVE-2026-25935 affects versions of the Vikunja API up to and including 0.24.6.
How can I identify if my application is vulnerable to CVE-2026-25935?
You can identify your application's vulnerability to CVE-2026-25935 by checking if it uses the affected version of the Vikunja API.