Vikunja Vulnerable to XSS Via Task Preview
Date: 2026-02
Affected: go/code.vikunja.io/api
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-25935
CWE: CWE-79
CWE-80

### Summary The task preview component creates a unparented div. The div's `innerHtml` is set to the unescaped description of the task ### Details In the `TaskGlanceTooltip.vue` it temporarily creates a div and sets the `innerHtml` to the description [here](https://github.com/go-vikunja/vikunja/blob/cdca79032526966cb248b72bddcf2a0f888c8a8f/frontend/src/components/tasks/partials/TaskGlanceTooltip.vue#L118). Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover. ### PoC 1. Create a project 2. Create a task with any description 3. Use the api to update the task with a description containing unescaped HTML (ex: `<img src=x onerror="alert(localStorage.getItem('token'))">` 4. Share the project with any permission level 5. Send malicious project to user and ask them to view task ### Impact Any user on an instance can cause an XSS on another


Mitigations:

Architectural layers (MAESTRO):