The vulnerability arises when the application renders a task description inside an invisible div without sanitizing the content. A malicious user can create a task with arbitrary JavaScript in the description, which then executes when another user hovers over that task’s preview. This could permit arbitrary code execution, session hijacking, or phishing attacks in the victim’s browser, compromising confidentiality, integrity, and availability of the web session.

The flaw affects the Vikunja task management application from the vendor go‑vikunja, specifically any release before version 1.1.0. Users running these earlier releases and sharing projects are susceptible to the attack.

The CVSS score of 8.6 classifies the issue as high severity, but the EPSS score is reported as less than 1 %, indicating a low likelihood of exploitation as of the latest data. It is not listed in the CISA KEV catalog. However, because the flaw can be triggered by any user who can create a task in a shared project, the attack vector is likely an internal or trusted‑user context, and the vulnerability remains exploitable until the upstream patch is applied.