CVE-2026-35601: Vikunja has iCalendar Property Injection via CRLF in CalDAV Task Output

April 10, 2026

The CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles containing CRLF characters break the iCalendar property boundary, allowing injection of arbitrary iCalendar properties such as ATTACH, VALARM, or ORGANIZER.

References

github.com/advisories/GHSA-2g7h-7rqr-9p4r
github.com/go-vikunja/vikunja
github.com/go-vikunja/vikunja/pull/2580
github.com/go-vikunja/vikunja/releases/tag/v2.3.0
github.com/go-vikunja/vikunja/security/advisories/GHSA-2g7h-7rqr-9p4r
nvd.nist.gov/vuln/detail/CVE-2026-35601

Code Behaviors & Features

Detect and mitigate CVE-2026-35601 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →