{"id":"EUVD-2026-21428","enisaUuid":"8214aab3-cb89-39c7-acec-a0dcf5072aca","description":"Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles containing CRLF characters break the iCalendar property boundary, allowing injection of arbitrary iCalendar properties such as ATTACH, VALARM, or ORGANIZER. This vulnerability is fixed in 2.3.0.","datePublished":"Apr 10, 2026, 4:08:50 PM","dateUpdated":"Apr 13, 2026, 3:37:03 PM","baseScore":4.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2g7h-7rqr-9p4r\nhttps://github.com/go-vikunja/vikunja/pull/2580\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.3.0\n","aliases":"CVE-2026-35601\nGHSA-2g7h-7rqr-9p4r\n","assigner":"GitHub_M","epss":0.2,"enisaIdProduct":[{"id":"982f2347-9fe7-310a-935f-60dfa9a56dc5","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"\u003c 2.3.0"}],"enisaIdVendor":[{"id":"e5aff035-f8a4-35fa-8614-c2e9fc40ed9e","vendor":{"name":"go-vikunja"}}],"enisaIdVulnerability":[{"id":"2038c1aa-f510-394b-9efe-e10b4b312be6","vulnerability":{"id":"CVE-2026-35601","description":"Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles containing CRLF characters break the iCalendar property boundary, allowing injection of arbitrary iCalendar properties such as ATTACH, VALARM, or ORGANIZER. This vulnerability is fixed in 2.3.0.","datePublished":"Apr 10, 2026, 4:08:50 PM","dateUpdated":"Apr 13, 2026, 3:37:03 PM","status":"PUBLISHED","baseScore":4.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2g7h-7rqr-9p4r\nhttps://github.com/go-vikunja/vikunja/pull/2580\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.3.0\n","enisa_id":"EUVD-2026-21428\n","assigner":"GitHub_M","epss":0.2,"dataProcessed":"Oct 27, 2026, 7:18:59 AM","vulnerabilityProduct":[{"id":"9dd5ef3b-1e8a-35d0-bbf9-f39b3e3ae319","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"\u003c 2.3.0"}],"vulnerabilityVendor":[{"id":"5823a501-3873-38e0-96b7-82c262be3b26","vendor":{"name":"go-vikunja"}}]}},{"id":"d34f39ce-8789-3dfc-a287-4cbfd7438d37","vulnerability":{"id":"GHSA-2g7h-7rqr-9p4r","description":"Vikunja has iCalendar Property Injection via CRLF in CalDAV Task Output","datePublished":"Apr 10, 2026, 3:35:05 PM","dateUpdated":"Jun 8, 2026, 8:08:35 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2g7h-7rqr-9p4r\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35601\nhttps://github.com/go-vikunja/vikunja/pull/2580\nhttps://github.com/go-vikunja/vikunja\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.3.0\n","enisa_id":"EUVD-2026-21428\n","aliases":"CVE-2026-35601\nGHSA-2g7h-7rqr-9p4r\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}