CVE-2026-33635: iCalendar has ICS injection via unsanitized URI property values
(updated )
.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.
References
- github.com/advisories/GHSA-pv9c-9mfh-hvxq
- github.com/icalendar/icalendar
- github.com/icalendar/icalendar/commit/b8d23b490363ee5fffaec1d269a8618a912ca265
- github.com/icalendar/icalendar/security/advisories/GHSA-pv9c-9mfh-hvxq
- github.com/rubysec/ruby-advisory-db/blob/master/gems/icalendar/CVE-2026-33635.yml
- nvd.nist.gov/vuln/detail/CVE-2026-33635
Code Behaviors & Features
Detect and mitigate CVE-2026-33635 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →