CVE-2026-33335HIGH 8.0EPSS p15.8%

CVE-2026-33335CVE-2026-33335

Description

Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper passes URLs from `window.open()` calls directly to `shell.openExternal()` without any validation or protocol allowlisting. An attacker who can place a link with `target="_blank"` (or that otherwise triggers `window.open`) in user-generated content can cause the victim's operating system to open arbitrary URI schemes, invoking local applications, opening local files, or triggering custom protocol handlers. Version 2.2.0 patches the issue.

Scoring

CVSS 3.18.0 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS0.25% probability of exploitation · percentile 15.8% · 2026-06-18T12:00:27Z
Published2026-03-24
Last modified2026-03-27

Underlying weaknesses· 1

CWE-939

References

  1. https://github.com/go-vikunja/vikunja/security/advisories/GHSA-6q44-85gc-cjvf
  2. https://vikunja.io/changelog/vikunja-v2.2.0-was-released
  3. https://github.com/go-vikunja/vikunja/security/advisories/GHSA-6q44-85gc-cjvf

1

TypeTargetConfidenceTier
WeaknessImproper Authorization in Handler for Custom URL Schemecwe-9390%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-33334
CVE
CVE-2026-33336
CVE
CVE-2026-27575
CVE
CVE-2026-33678
CVE
CVE-2026-33668
CVE
CVE-2026-33316
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.