Security Advisory

CVE-2026-25935

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2026-02-11 20:47:53

Last updated 2026-02-12 21:17:32

Assigner GitHub_M

State PUBLISHED

Description

Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover. This vulnerability is fixed in 1.1.0.

← Browse all CVEs View on cve.org ↗