{"id":"CVE-2026-25935","aliases":["GHSA-m4g2-2q66-vc9v","GO-2026-4480"],"url":"https://o3.security/vulnerability/CVE-2026-25935","summary":"Vikunja Affected by XSS Via Task Preview","details":"### Summary\nThe task preview component creates a unparented div. The div's `innerHtml` is set to the unescaped description of the task\n\n### Details\nIn the `TaskGlanceTooltip.vue` it temporarily creates a div and sets the `innerHtml` to the description [here](https://github.com/go-vikunja/vikunja/blob/cdca79032526966cb248b72bddcf2a0f888c8a8f/frontend/src/components/tasks/partials/TaskGlanceTooltip.vue#L118). Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover.\n\n### PoC\n1. Create a project\n2. Create a task with any description\n3. Use the api to update the task with a description containing unescaped HTML (ex: `<img src=x onerror=\"alert(localStorage.getItem('token'))\">`\n4. Share the project with any permission level\n5. Send malicious project to user and ask them to view task\n\n### Impact\nAny user on an instance can cause an XSS on another","published":"2026-02-11T20:47:53.291Z","modified":"2026-08-12T03:51:11.463458350Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"code.vikunja.io/api","fixedVersion":null}],"fix":{"url":"https://github.com/go-vikunja/vikunja/commit/dd0b82f00a8c9ded1c19a1e643a197c514be6d37","label":"go-vikunja/vikunja@dd0b82f"},"references":[{"type":"WEB","url":"https://github.com/go-vikunja/vikunja/releases/tag/v1.1.0"},{"type":"WEB","url":"https://vikunja.io/changelog/vikunja-v1.1.0-was-released"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25935.json"},{"type":"ADVISORY","url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m4g2-2q66-vc9v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25935"},{"type":"FIX","url":"https://github.com/go-vikunja/vikunja/commit/dd0b82f00a8c9ded1c19a1e643a197c514be6d37"},{"type":"PACKAGE","url":"https://github.com/go-vikunja/vikunja"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:11.463458350Z"}}