Executive Summary

CVE-2026-25935 is a high-severity Cross-Site Scripting (XSS) vulnerability in the Vikunja todo-app affecting versions up to 1.0.0. The vulnerability occurs because the TaskGlanceTooltip.vue component creates a temporary div element and sets its innerHTML directly to the task description without any escaping or sanitization on either the client or server side.

This allows a malicious user to inject arbitrary HTML or JavaScript code into a task description. When a victim user hovers over the malicious task preview, the injected script executes in their browser context, potentially leading to unauthorized actions or data theft.

The vulnerability is fixed in Vikunja version 1.1.0.

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': "This vulnerability can have serious impacts including the execution of arbitrary scripts in the victim's browser, which can lead to the exfiltration of sensitive data such as authentication tokens."}, {'type': 'paragraph', 'content': 'An attacker can inject malicious code into task descriptions and cause it to run when other users hover over the task preview, potentially compromising confidentiality and integrity of user data.'}, {'type': 'list_item', 'content': 'High impact on confidentiality: sensitive data can be stolen.'}, {'type': 'list_item', 'content': 'High impact on integrity: unauthorized modification of data is possible.'}, {'type': 'paragraph', 'content': 'No impact on availability has been reported.'}] [1]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying task descriptions containing unescaped HTML or JavaScript code that could trigger Cross-Site Scripting (XSS) when previewed. Specifically, look for tasks with descriptions including HTML tags such as <img> with event handlers like onerror.

Since the vulnerability triggers when a user hovers over a malicious task preview, network detection could involve monitoring for suspicious payloads in task descriptions or unusual script execution attempts in client browsers.

There are no explicit commands provided in the resources to detect this vulnerability on your system or network.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and recommended mitigation step is to upgrade Vikunja to version 1.1.0 or later, which contains the fix for CVE-2026-25935.

The fix involves replacing the vulnerable method of rendering task descriptions that used innerHTML with a safer approach using the DOMParser API to extract plain text, preventing script injection.

Users should replace the Vikunja binary with the updated release or pull the latest Docker image containing version 1.1.0.

Useful 0 Not Useful 0