CVE-2026-25935

Katalog CVE

CVSS 5.4 · Medium EPSS 0,38%

Kerentanan Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) pada vikunja. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover. This vulnerability is fixed in 1.1.0.

Rincian

Terbit di NVD

11 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/go-vikunja/vikunja/commit/dd0b82f00a8c9ded1c19a1e643a197c514be6d37 patch
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m4g2-2q66-vc9v advisory pihak ketiga
• https://vikunja.io/changelog/vikunja-v1.1.0-was-released release notes · advisory pihak ketiga
• https://github.com/go-vikunja/vikunja/releases/tag/v1.1.0 product · release notes