CVE-2026-33335: Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal

Vulnerability summary

CVE-2026-33335 is a high (CVSS 8.0) vulnerability in go-vikunja vikunja. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 24-03-2026
   PublishedVulnerability first disclosed.
2. 25-03-2026
   Last modifiedVulnerability information updated.

Description

Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper passes URLs from `window.open()` calls directly to `shell.openExternal()` without any validation or protocol allowlisting. An attacker who can place a link with `target="_blank"` (or that otherwise triggers `window.open`) in user-generated content can cause the victim's operating system to open arbitrary URI schemes, invoking local applications, opening local files, or triggering custom protocol handlers. Version 2.2.0 patches the issue.

• CWE-939Improper Authorization in Handler for Custom URL SchemeThe product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.