CVE-2026-33335

The record

Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper passes URLs from `window.open()` calls directly to `shell.openExternal()` without any validation or protocol allowlisting. An attacker who can place a link with `target="_blank"` (or that otherwise triggers `window.open`) in user-generated content can cause the victim's operating system to open arbitrary URI schemes, invoking local applications, opening local files, or triggering custom protocol handlers. Version 2.2.0 patches the issue.

Affected packages

Related vulnerabilities

• CVE-2026-73335 Android application "Myna Point" is vulnerable to Improper Authorization in Handler for… CWE-939
• CVE-2026-21075 Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3… CWE-939
• CVE-2026-21062 Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local… CWE-939
• CVE-2026-59717 Home Assistant is open source home automation software focused on local control and… CWE-939
• CVE-2026-12189 A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. CWE-939
• CVE-2026-12190 A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. CWE-939
• CVE-2026-53408 Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version… CWE-939
• CVE-2026-53407 Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version… CWE-939