https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T01:52:54.085864+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-268260 EUVD-2026-268260 2026-10-06T01:52:54.179009+00:00 EUVD-2026-268260 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25935 fkie_cve-2026-25935 2026-10-06T01:52:54.179045+00:00

Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover. This vulnerability is fixed in 1.1.0.

 https://cve.radiocsirt.org/vuln/ghsa-m4g2-2q66-vc9v GHSA-m4g2-2q66-vc9v — Vikunja Vulnerable to XSS Via Task Preview 2026-10-06T01:52:54.179078+00:00

Affected: Go: code.vikunja.io/api

### Summary The task preview component creates a unparented div. The div's `innerHtml` is set to the unescaped description of the task

### Details In the `TaskGlanceTooltip.vue` it temporarily creates a div and sets the `innerHtml` to the description [here](https://github.com/go-vikunja/vikunja/blob/cdca79032526966cb248b72bddcf2a0f888c8a8f/frontend/src/components/tasks/partials/TaskGlanceTooltip.vue#L118). Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover.

### PoC 1. Create a project 2. Create a task with any description 3. Use the api to update the task with a description containing unescaped HTML (ex: `<img src=x onerror="alert(localStorage.getItem('token'))">` 4. Share the project with any permission level 5. Send malicious project to user and ask them to view task

### Impact Any user on an instance can cause an XSS on another