← Back

Doist

doist

2 CVEs • 1 product

Products (1)

Click to collapse
Toggle
Todoist
todoist
2 CVEs

CVEs (2)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2025-63317
1Doist
1Todoist
Jun 17, 2026
Dec 1, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Todoist v8896 is vulnerable to Cross Site Scripting (XSS) in /api/v1/uploads. Uploaded SVG files have no sanitization applied, so embedded JavaScript executes when a user opens the attachment from a task/comment.
CVE-2025-57292
1Doist
1Todoist
Jun 17, 2026
Sep 26, 2025
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to properly validate the MIME type and sanitize image metadata.