CVE-2026-33335
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper passes URLs from `window.open()` calls directly to `shell.openExternal()` without any validation or protocol allowlisting. An attacker who can place a link with `target="_blank"` (or that otherwise triggers `window.open`) in user-generated content can cause the victim's operating system to open arbitrary URI schemes, invoking local applications, opening local files, or triggering custom protocol handlers. Version 2.2.0 patches the issue.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.4
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
- EPSS probability
- 0.25%
- CWE
- CWE-939
- Published
- 2026-03-24
- Last modified
- 2026-03-25
Affected products
- go-vikunja vikunja
Weakness type
Related vulnerabilities
- CVE-2026-73335 — Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL...
- CVE-2026-59717 — Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing
- CVE-2026-12190 — Genspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url scheme
- CVE-2026-12189 — Moovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url scheme
- CVE-2026-53408 — Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for...
- CVE-2026-53407 — Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for...
- CVE-2026-12065 — Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme
- CVE-2026-6445 — A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose...