PT-2026-27632 · Calendar · Calendar

CVE-2026-33635 · Publicado 2026-03-24 · Atualizado 2026-03-26

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions icalendar (affected versions not specified)

Description The software does not properly sanitize URI property values during .ics serialization, leading to ICS injection. This allows attackers to inject arbitrary calendar lines through controlled input. Specifically, the Icalendar::Values::Uri class fails to properly handle or escape carriage return (r) and line feed ( ) characters within URI values. When URI.parse fails, the raw input string is used and serialized without removing or escaping these characters, potentially terminating the original property and creating new ICS properties or components. Affected properties include url, source, image, organizer, attach, attendee, conference, and tzurl. This can result in downstream calendar clients processing attacker-supplied content as legitimate event data, such as added attendees or modified URLs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-93

Identificadores relacionados

CVE-2026-33635

GHSA-PV9C-9MFH-HVXQ

Produtos afetados

Calendar

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33635.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/icalendar/CVE-2026-33635.yml · Exploit
• https://github.com/icalendar/icalendar/commit/b8d23b490363ee5fffaec1d269a8618a912ca265 · Correção
• https://github.com/icalendar/icalendar/security/advisories/GHSA-pv9c-9mfh-hvxq · Aviso do Fabricante
• https://github.com/icalendar/icalendar · Nota
• https://twitter.com/rubylandnews/status/2036795395951476884 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-pv9c-9mfh-hvxq · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-33635 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2026-33635 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33635 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33635 · Nota de Segurança
• https://ubuntu.com/security/CVE-2026-33635 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33635 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33635 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037280536432173503 · Publicação no Twitter