CVE-2026-33334 is a critical flaw (CVSS 9.6) in the Vikunja Desktop Electron app. It enables nodeIntegration without context isolation or a sandbox, so any cross site scripting bug in the frontend becomes remote code execution on the user's machine. Update to Vikunja 2.2.0.
What's affected
Vikunja from version 0.21.0 and before 2.2.0, specifically the Desktop Electron wrapper. The advisory and the 2.2.0 changelog both name 2.2.0 as the fixed release. The browser based web app is a different surface, though the underlying XSS risk still applies there in its usual, smaller form.
How to check if you're exposed
Open the desktop app's About or version screen, or check the installer you used, and compare with 2.2.0. If you only use Vikunja in a browser, this specific escalation does not apply to you.
What to do now
- Update Vikunja Desktop to 2.2.0 or later.
- Update the server too. The same release fixed several other issues, three in the Desktop wrapper and seven in the API, according to the changelog.
- Until the desktop app is updated, consider using the web interface in a browser instead.
- Be cautious with links and content in shared tasks from people you do not trust.
Why it matters
Electron apps run web content with a lot of power if configured that way. With nodeIntegration on, scripts in the page can reach Node.js modules for files, processes and the network. The advisory notes that this raises a Medium or High web XSS to a Critical code execution bug on the desktop.
The record lists CWE-269, CWE-79 and CWE-94. The vulnerability needs an XSS to exist first, and the advisory describes that as present or future, not a confirmed one. The fix turned off nodeIntegration and enabled context isolation and sandboxing. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Do I need to worry if I patched the web frontend?
Yes. The flaw is in how the desktop shell is configured. The fix is to update the desktop app itself.
Sources
Last reviewed: 19 October 2026.
