Stored CSS Injection in Vikunja Prior to 2.7.1

Executive Summary

This is a stored CSS injection vulnerability in Vikunja versions before 2.7.1. An authenticated user with project write access can inject malicious CSS via unsanitized table-cell data-background-color attributes. When other users view the affected task or comment, the CSS is rendered in their browser, enabling phishing overlays or tracking requests.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Vikunja instances for unsanitized CSS injection in task descriptions or comments. Check for malicious CSS in data-background-color attributes or style tags. Review project descriptions for retained style attributes. Use browser developer tools to inspect rendered HTML for injected CSS rules.

Useful 0 Not Useful 0

Impact Analysis

Attackers can create full-viewport phishing overlays to steal credentials or force background-image requests to deanonymize users. Exploitation requires user interaction but can be done by any authenticated user with write access to a project.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade Vikunja to version 2.7.1 or later to patch the vulnerability.
• Review and sanitize user-generated content, particularly task descriptions and comments, to remove unsanitized CSS.
• Adjust DOMPurify configuration to block style attributes and form elements in project descriptions.
• Restrict project write access to trusted users to reduce attack surface.

Useful 0 Not Useful 0