Vikunja Desktop, the Electron wrapper for the open‑source task platform, allows full Node.js access in its main window because nodeIntegration is enabled. The application also lacks navigation controls, so clicking a link in any user‑generated content can load an external origin in the same window. Since the renderer process already has node access, the external page can execute code, giving the attacker the ability to read or write arbitrary files, run commands, or install malware on the victim’s machine. This flaw is a classic example of CWE‑94, an arbitrary code execution vulnerability through misconfiguration.

Vikunja Desktop, version 0.21.0 through any pre‑2.2.0 release, is affected. The vulnerability exists in both the Electron wrapper and the underlying Vikunja application as distributed in those releases.

The CVSS score of 6.5 indicates medium impact, and the EPSS score is below 1 %, suggesting low current exploitation probability, though the flaw remains present in many installations. Because the attacker only needs to place an HTML link in a task or project description—an action allowed for normal users on the same instance—the risk is significant for environments where multiple users share projects. No special privilege escalation beyond the app user is required; the exploit can be triggered simply by opening the link from the desktop client, so mitigations such as upgrading to v2.2.0 or disabling nodeIntegration are strongly recommended. The flaw is not listed in the CISA KEV catalog, but its medium CVSS and potential for lateral damage warrant prompt attention.