Description (CNA)
Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover. This vulnerability is fixed in 1.1.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| go-vikunja / vikunja | affected < 1.1.0 |
CWE
CWE-80
References
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m4g2-2q66-vc9v
- https://github.com/go-vikunja/vikunja/commit/dd0b82f00a8c9ded1c19a1e643a197c514be6d37
- https://github.com/go-vikunja/vikunja/releases/tag/v1.1.0
- https://vikunja.io/changelog/vikunja-v1.1.0-was-released
ADP enrichment
No English description supplied.
No references supplied.