Vikunja’s Projects module renders the URL query parameter ‘filter’ into the page without proper output encoding. Although common executable tags are blocked, tags such as <svg>, <a>, and formatting elements (<h1>, <b>, <u>) are rendered unfiltered, enabling attackers to inject malicious SVG-based phishing buttons, external redirect links and visually deceptive content within the trusted application origin. This is a reflected cross‑site scripting vulnerability (CWE‑79, CWE‑80).

The vulnerability affects all versions of Vikunja earlier than 2.0.0. Users running any 1.x or pre‑2.0.0 release are at risk because the Projects module does not perform output encoding for the ‘filter’ URL parameter.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score is below 1 %, suggesting exploitation is unlikely but still feasible, especially if users are tricked into entering malicious filter values or if the application is exposed to unknown users. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a malicious URL with a harmful ‘filter’ parameter and luring a victim to visit it within the application context. Because the reflected content is displayed inside the same origin, the impact is limited to information disclosure, UI spoofing and phishing, rather than remote code execution.