{"id":"CVE-2026-35601","revision":"4b62779c23b5407baee3c06a731499ab","records":[{"revision":"4b62779c23b5407baee3c06a731499ab","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-35601","aliases":[],"title":"Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output","description":"Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles containing CRLF characters break the iCalendar property boundary, allowing injection of arbitrary iCalendar properties such as ATTACH, VALARM, or ORGANIZER. This vulnerability is fixed in 2.3.0.","state":0,"publishedAt":"2026-04-10T16:08:50.519+00:00","modifiedAt":"2026-04-13T15:37:03.974+00:00","affected":[{"ecosystem":"Vendor product","name":"vikunja","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"go-vikunja\",\n                    \"product\": \"vikunja\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.3.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","score":4.1,"severity":"MEDIUM"}],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2g7h-7rqr-9p4r","https://github.com/go-vikunja/vikunja/pull/2580","https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-35601","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-35601","identifiers":["CVE-2026-35601"]},"retained":false,"historicalAffected":[]}],"coverage":[]}