CVE-2026-33334: Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables nodeIntegration in the renderer process without contextIsolation or sandbox. This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected scripts gain access to Node.js APIs. Version 2.2.0 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33334?
CVE-2026-33334 is considered a critical vulnerability due to its potential for Remote Code Execution.
How do I fix CVE-2026-33334?
To mitigate CVE-2026-33334, upgrade Vikunja Desktop to version 2.2.0 or later.
What type of vulnerability is CVE-2026-33334?
CVE-2026-33334 is an XSS vulnerability that can escalate to Remote Code Execution.
Which versions are affected by CVE-2026-33334?
CVE-2026-33334 affects Vikunja Desktop versions from 0.21.0 to 2.2.0, excluding 2.2.0.
What does 'nodeIntegration' mean in the context of CVE-2026-33334?
In CVE-2026-33334, 'nodeIntegration' refers to the Electron feature that allows Node.js to be used in the renderer process, increasing security risks.