PT-2026-27632 · Calendar · Calendar

Published 2026-03-24 · Updated 2026-03-26 · CVE-2026-33635

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions icalendar (affected versions not specified)

Description The software does not properly sanitize URI property values during .ics serialization, leading to ICS injection. This allows attackers to inject arbitrary calendar lines through controlled input. Specifically, the Icalendar::Values::Uri class fails to properly handle or escape carriage return (r) and line feed ( ) characters within URI values. When URI.parse fails, the raw input string is used and serialized without removing or escaping these characters, potentially terminating the original property and creating new ICS properties or components. Affected properties include url, source, image, organizer, attach, attendee, conference, and tzurl. This can result in downstream calendar clients processing attacker-supplied content as legitimate event data, such as added attendees or modified URLs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-33635

GHSA-PV9C-9MFH-HVXQ

Affected Products

Calendar

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33635.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/icalendar/CVE-2026-33635.yml · Exploit
• https://github.com/icalendar/icalendar/commit/b8d23b490363ee5fffaec1d269a8618a912ca265 · Patch
• https://github.com/icalendar/icalendar/security/advisories/GHSA-pv9c-9mfh-hvxq · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pv9c-9mfh-hvxq · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33635 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-33635 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33635 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33635 · Security Note
• https://ubuntu.com/security/CVE-2026-33635 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33635 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33635 · Vendor Advisory
• https://github.com/icalendar/icalendar · Note
• https://twitter.com/rubylandnews/status/2036795395951476884 · Twitter Post
• https://twitter.com/CVEnew/status/2037280536432173503 · Twitter Post