CVE-2026-33336 is a critical arbitrary code execution vulnerability affecting Vikunja Desktop versions 0.21.0 through 2.1.x. It stems from the Electron wrapper enabling Node.js integration and failing to restrict same-window navigations. An attacker can embed a malicious link in user-generated content, which, when clicked by a victim, causes the application to navigate to an attacker-controlled page. This allows arbitrary code to execute with full Node.js access, leading to complete remote code execution on the victim's machine. The vulnerability has a CVSS score of 8.8 (High), and while no active exploitation or public exploit code is reported, a proof-of-concept exists demonstrating its ease of exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0.21.0, < 2.2.2CPE matchmatch criteria | cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.