CVE-2026-25935
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in Vikunja todo application where malicious HTML/JavaScript can be injected into task descriptions. When users hover over affected tasks, the injected code executes in their browser context. All Vikunja instances running versions before 1.1.0 are affected.
💻 Affected Systems
- Vikunja
📦 What is this software?
Vikunja by Vikunja
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on user systems.
Likely Case
Session hijacking, credential theft, or unauthorized actions performed within the Vikunja application.
If Mitigated
Limited impact if proper content security policies are enforced and users have minimal privileges.
🎯 Exploit Status
Requires authenticated user to create malicious task and another user to hover over it. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.0
Vendor Advisory: https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m4g2-2q66-vc9v
Restart Required: No
Instructions:
1. Backup your Vikunja instance. 2. Update to version 1.1.0 or later using your package manager or download from GitHub releases. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable task sharing
allPrevent users from sharing projects/tasks to limit attack surface
Implement Content Security Policy
allAdd CSP headers to restrict script execution
Add 'Content-Security-Policy: default-src 'self'' to web server configuration
🧯 If You Can't Patch
- Disable hover tooltips in TaskGlanceTooltip.vue component
- Implement input validation to sanitize HTML in task descriptions
🔍 How to Verify
Check if Vulnerable:
Check Vikunja version in admin panel or via API. If version is below 1.1.0, you are vulnerable.Check Version:
Check Vikunja web interface admin panel or run: docker exec vikunja ./vikunja versionVerify Fix Applied:
After updating to 1.1.0+, verify that HTML in task descriptions is properly escaped when displayed in tooltips.📡 Detection & Monitoring
Log Indicators:
- Unusual task creation/modification patterns
- Multiple failed login attempts followed by task creation
Network Indicators:
- Suspicious JavaScript payloads in HTTP POST requests to task endpoints
SIEM Query:
source="vikunja" AND (event="task_create" OR event="task_update") AND description CONTAINS "<script>"