CVE-2026-27116: Vikunja Task Management XSS Vulnerability

CVE-2026-27116 Overview

CVE-2026-27116 is a reflected HTML injection vulnerability affecting Vikunja, an open-source self-hosted task management platform. The vulnerability exists in the Projects module where the filter URL parameter is rendered into the DOM without proper output encoding when users click the "Filter" action. While certain dangerous elements like <script> and <iframe> are blocked, other HTML elements including <svg>, <a>, and formatting tags (<h1>, <b>, <u>) render without restriction. This enables attackers to craft malicious URLs that can deliver SVG-based phishing buttons, external redirect links, and content spoofing within the trusted application origin.

Critical Impact

Attackers can leverage this HTML injection flaw to conduct phishing attacks, redirect users to malicious sites, and spoof content within the trusted Vikunja application context, potentially compromising user credentials and data.

Affected Products

• Vikunja versions prior to 2.0.0

Discovery Timeline

• 2026-02-25 - CVE CVE-2026-27116 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-27116

Vulnerability Analysis

This vulnerability falls under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw resides in the Projects module's handling of user-controlled input from the filter URL parameter.

When a user interacts with the Filter functionality, the application renders the filter parameter value directly into the DOM without applying proper output encoding or sanitization. The application implements a partial blocklist approach that filters out <script> and <iframe> tags, but this defense is insufficient as it allows numerous other potentially dangerous HTML elements to pass through unfiltered.

The attack requires network access and user interaction—specifically, a victim must click a crafted malicious link. Upon successful exploitation, an attacker can manipulate the visual presentation of the application page within the user's browser session. Since the injected content appears within the legitimate Vikunja domain, users are more likely to trust malicious content presented through this vector.

Root Cause

The root cause stems from insufficient output encoding applied to the filter URL parameter before rendering it into the DOM. The application relies on an incomplete blocklist approach that only filters <script> and <iframe> elements while permitting other HTML tags that can be weaponized for phishing and social engineering attacks.

Proper mitigation requires implementing comprehensive output encoding (such as HTML entity encoding) for all user-controlled input rendered into HTML contexts, rather than relying on blocklists of specific tags.

Attack Vector

The attack is executed over the network where an attacker crafts a malicious URL containing HTML payload in the filter parameter. The attacker then distributes this URL through phishing emails, social media, or other channels.

When a victim clicks the malicious link and subsequently clicks the "Filter" button within the application, the injected HTML is rendered in their browser within the trusted Vikunja domain context. This allows attackers to:

• Display SVG-based fake buttons that appear legitimate but trigger malicious actions
• Create convincing anchor tags that redirect users to external phishing sites
• Spoof application content using formatting tags to display fake messages or warnings
• Manipulate the visual presentation to harvest credentials or sensitive information

Since the injected content operates within the legitimate application origin, it inherits the trust users place in the Vikunja platform.

Detection Methods for CVE-2026-27116

Indicators of Compromise

• Unusual URL patterns containing HTML tags in the filter parameter of Projects module requests
• Presence of <svg>, <a>, <h1>, <b>, or <u> tags within URL query strings in web server access logs
• User reports of unexpected visual elements or redirects occurring within the Vikunja application

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing HTML tags in URL parameters
• Monitor web server access logs for encoded or plaintext HTML elements in query strings (e.g., %3Csvg, %3Ca, <svg>, <a>)
• Deploy browser-based security monitoring to detect DOM manipulation from URL parameters

Monitoring Recommendations

• Review access logs for the Projects module endpoints with unusual filter parameter values
• Alert on spikes in external redirect traffic originating from users accessing Vikunja pages
• Monitor for user-reported phishing attempts that reference legitimate Vikunja URLs

How to Mitigate CVE-2026-27116

Immediate Actions Required

• Upgrade Vikunja to version 2.0.0 or later immediately
• Audit web server logs for any evidence of exploitation attempts
• Notify users about potential phishing attacks leveraging this vulnerability
• Consider implementing Content Security Policy (CSP) headers as an additional defense layer

Patch Information

Vikunja version 2.0.0 addresses this vulnerability by implementing proper output encoding for the filter parameter. Users should upgrade to this version or later to remediate the issue. For detailed information, refer to the GitHub Security Advisory GHSA-4qgr-4h56-8895 and the Vikunja v2.0.0 Release Announcement.

Workarounds

• Deploy a web application firewall (WAF) rule to sanitize or block HTML tags in the filter URL parameter
• Implement reverse proxy filtering to strip potentially malicious characters from query strings before they reach the application
• Educate users to be cautious of unexpected Vikunja URLs received via email or external sources until the patch can be applied