CVE-2026-33335: Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper passes URLs from window.open() calls directly to shell.openExternal() without any validation or protocol allowlisting. An attacker who can place a link with target="blank" (or that otherwise triggers window.open) in user-generated content can cause the victim's operating system to open arbitrary URI schemes, invoking local applications, opening local files, or triggering custom protocol handlers. Version 2.2.0 patches the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33335?
CVE-2026-33335 is considered a high severity vulnerability due to its potential for arbitrary local application invocation.
How do I fix CVE-2026-33335?
To fix CVE-2026-33335, upgrade Vikunja Desktop to version 2.2.0 or later.
What versions of Vikunja Desktop are affected by CVE-2026-33335?
CVE-2026-33335 affects Vikunja Desktop versions from 0.21.0 up to but not including 2.2.0.
What kind of attack does CVE-2026-33335 facilitate?
CVE-2026-33335 facilitates arbitrary command execution through unvalidated shell.openExternal calls.
Is CVE-2026-33335 specific to any operating system?
CVE-2026-33335 is not specific to any operating system as it affects the Vikunja Desktop application regardless of the OS.