Beveiligingsadvies

CVE-2026-33335

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-03-24 15:07:41

Laatst bijgewerkt 2026-03-25 13:41:50

Toegewezen door GitHub_M

CVSS-score 6.4

Status PUBLISHED

Beschrijving

Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper passes URLs from `window.open()` calls directly to `shell.openExternal()` without any validation or protocol allowlisting. An attacker who can place a link with `target="_blank"` (or that otherwise triggers `window.open`) in user-generated content can cause the victim's operating system to open arbitrary URI schemes, invoking local applications, opening local files, or triggering custom protocol handlers. Version 2.2.0 patches the issue.

← Alle CVE's bekijken Bekijk op cve.org ↗