https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 03:30:36 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-268260 EUVD-2026-268260 https://cve.radiocsirt.org/vuln/euvd-2026-268260 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25935 <p>Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover. This vulnerability is fixed in 1.1.0.</p> <p>Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover. This vulnerability is fixed in 1.1.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-25935 https://cve.radiocsirt.org/vuln/ghsa-m4g2-2q66-vc9v <p><strong>Affected:</strong> Go: code.vikunja.io/api</p> <p>### Summary The task preview component creates a unparented div. The div&#39;s `innerHtml` is set to the unescaped description of the task</p> <p>### Details In the `TaskGlanceTooltip.vue` it temporarily creates a div and sets the `innerHtml` to the description [here](https://github.com/go-vikunja/vikunja/blob/cdca79032526966cb248b72bddcf2a0f888c8a8f/frontend/src/components/tasks/partials/TaskGlanceTooltip.vue#L118). Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover.</p> <p>### PoC 1. Create a project 2. Create a task with any description 3. Use the api to update the task with a description containing unescaped HTML (ex: `&lt;img src=x onerror=&#34;alert(localStorage.getItem(&#39;token&#39;))&#34;&gt;` 4. Share the project with any permission level 5. Send malicious project to user and ask them to view task</p> <p>### Impact Any user on an instance can cause an XSS on another</p> <p><strong>Affected:</strong> Go: code.vikunja.io/api</p> <p>### Summary The task preview component creates a unparented div. The div&#39;s `innerHtml` is set to the unescaped description of the task</p> <p>### Details In the `TaskGlanceTooltip.vue` it temporarily creates a div and sets the `innerHtml` to the description [here](https://github.com/go-vikunja/vikunja/blob/cdca79032526966cb248b72bddcf2a0f888c8a8f/frontend/src/components/tasks/partials/TaskGlanceTooltip.vue#L118). Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover.</p> <p>### PoC 1. Create a project 2. Create a task with any description 3. Use the api to update the task with a description containing unescaped HTML (ex: `&lt;img src=x onerror=&#34;alert(localStorage.getItem(&#39;token&#39;))&#34;&gt;` 4. Share the project with any permission level 5. Send malicious project to user and ask them to view task</p> <p>### Impact Any user on an instance can cause an XSS on another</p> https://cve.radiocsirt.org/vuln/ghsa-m4g2-2q66-vc9v