The vulnerability resides in the Vikunja Desktop Electron wrapper, which enables nodeIntegration in the renderer process without the protections of contextIsolation or a sandbox. As a result, any cross‑site scripting flaw present in the web frontend—whether discovered now or introduced later—gains direct access to Node.js APIs. The attacker can therefore run arbitrary code on the victim’s machine, achieving full compromise of confidentiality, integrity, and availability of that system.

The affected vendor is go‑vikunja and the product is Vikunja Desktop. All releases from version 0.21.0 up to, but not including, 2.2.0 are vulnerable. The 2.2.0 release and newer have the issue resolved.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of less than 1% suggests low predicted exploitation prevalence. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires an XSS vector in the Vikunja web interface; once an attacker injects malicious script, the Electron wrapper’s nodeIntegration lifts the boundary, allowing the script to invoke Node APIs and execute arbitrary code. No additional prerequisites are needed beyond the ability to induce XSS in a user’s browser session.