{"schema_version":"1.7.3","id":"GHSA-m4g2-2q66-vc9v","published":"2026-02-11T18:39:34Z","modified":"2026-02-19T20:40:57.637800Z","aliases":["CVE-2026-25935","GO-2026-4480"],"summary":"Vikunja Vulnerable to XSS Via Task Preview","details":"### Summary\nThe task preview component creates a unparented div. The div's `innerHtml` is set to the unescaped description of the task\n\n### Details\nIn the `TaskGlanceTooltip.vue` it temporarily creates a div and sets the `innerHtml` to the description [here](https://github.com/go-vikunja/vikunja/blob/cdca79032526966cb248b72bddcf2a0f888c8a8f/frontend/src/components/tasks/partials/TaskGlanceTooltip.vue#L118). Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover.\n\n### PoC\n1. Create a project\n2. Create a task with any description\n3. Use the api to update the task with a description containing unescaped HTML (ex: `<img src=x onerror=\"alert(localStorage.getItem('token'))\">`\n4. Share the project with any permission level\n5. Send malicious project to user and ask them to view task\n\n### Impact\nAny user on an instance can cause an XSS on another","affected":[{"package":{"name":"code.vikunja.io/api","ecosystem":"Go","purl":"pkg:golang/code.vikunja.io/api"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.24.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-m4g2-2q66-vc9v/GHSA-m4g2-2q66-vc9v.json"}}],"references":[{"type":"WEB","url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m4g2-2q66-vc9v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25935"},{"type":"WEB","url":"https://github.com/go-vikunja/vikunja/commit/dd0b82f00a8c9ded1c19a1e643a197c514be6d37"},{"type":"PACKAGE","url":"https://github.com/go-vikunja/vikunja"},{"type":"WEB","url":"https://github.com/go-vikunja/vikunja/releases/tag/v1.1.0"},{"type":"WEB","url":"https://vikunja.io/changelog/vikunja-v1.1.0-was-released"}],"database_specific":{"cwe_ids":["CWE-79","CWE-80"],"github_reviewed":true,"github_reviewed_at":"2026-02-11T18:39:34Z","nvd_published_at":"2026-02-11T21:16:20Z","severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}