CVE-2026-35601: Vikunja CRLF injection in CalDAV output generator

Executive brief

Vikunja is an open-source task management platform. A vulnerability in its calendar synchronization component allows users to inject malicious data into shared projects. An attacker could use this to trick other users' calendar applications into downloading malicious files, displaying fake alerts, or spoofing meeting organizers, potentially leading to malware infections or social engineering attacks.

Technical details

The CalDAV output generator in Vikunja (specifically the ParseTodos function in pkg/caldav/caldav.go) builds iCalendar VTODO entries using raw string concatenation. It fails to apply RFC 5545 TEXT value escaping to user-controlled fields such as task summaries, categories, and descriptions. An authenticated attacker with write access to a project can use the REST API to create tasks containing CRLF characters. When these tasks are retrieved via CalDAV, the newlines break the property boundary, allowing the injection of arbitrary iCalendar properties. This can be used to inject malicious attachment URLs (ATTACH), fake alarms (VALARM), or spoofed organizers. The issue is fixed in version 2.3.0.

Affected products

• Vikunja Vikunja <= 2.2.2

Timeline

• 2026-04-09: disclosed
• 2026-04-09: patched: Fixed in version 2.3.0
• 2026-04-10: advisory

References

• https://api.github.com/users/adrgs
• https://github.com/adrgs
• https://api.github.com/users/adrgs/gists%7B/gist_id%7D
• https://api.github.com/users/adrgs/repos
• https://avatars.githubusercontent.com/u/11564377?v=4
• https://api.github.com/users/adrgs/events%7B/privacy%7D