A stored cross-site scripting vulnerability in Vikunja allows authenticated users to execute malicious scripts in the context of other users, leading to potential session hijacking.

This is a stored cross-site scripting (CWE-79) vulnerability where the application fails to sanitize SVG files during upload. An authenticated attacker can upload a crafted SVG containing malicious JavaScript, which executes when accessed by another user, allowing the exfiltration of authentication tokens stored in local storage.

Successful exploitation allows an attacker to compromise the session and account of any user who views a malicious attachment. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to unauthorized data access, administrative takeover, and significant reputational damage.

Immediate Action: Upgrade to Vikunja version 2.0.0 or later immediately to implement the required SVG sanitization logic.

Proactive Monitoring: Review application access logs for suspicious SVG file uploads and monitor for anomalous outbound traffic originating from the browser sessions of administrative users.

Compensating Controls: Implement a Content Security Policy (CSP) that restricts script execution and prevents the loading of inline resources from untrusted sources, which may mitigate the impact of this XSS flaw.

Public Exploit Available: Yes, a proof-of-concept is documented in the security advisory referenced by the project.

This vulnerability presents a significant risk to user data integrity and session security. Administrators must prioritize updating their Vikunja instances to version 2.0.0 to remediate the underlying sanitization flaw. Failure to patch leaves user sessions vulnerable to theft and unauthorized account access.