Vikunja Desktop’s Electron wrapper forwards URLs from window.open() calls directly to shell.openExternal() without validating or restricting the protocols. An attacker who can insert a link—such as one with target="_blank"—into user‑generated content can cause the victim’s operating system to open any URI scheme. The OS then launches the associated application, opens a local file, or triggers a custom protocol handler, effectively giving the attacker the ability to invoke local applications or access local resources.

The vulnerability is present in Vikunja Desktop releases starting with version 0.21.0 and continues through all builds prior to version 2.2.0. Users running any earlier Vikunja Desktop client are exposed. The product is an open‑source, self‑hosted task‑management platform distributed by the Vikunja organization.

The overall severity rating of the defect is moderate with a score of 6.4. Estimated exploitation probability is less than 1%, and the vulnerability is not listed in the Known Exploited Vulnerabilities catalog. Exploitation requires malicious user‑generated content containing an actionable link and front‑end interaction by the victim, indicating a client‑side, socially engineered attack vector.