Is CVE-2026-77353 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77353 being exploited in the wild.

How severe is CVE-2026-77353?

Medium severity, with a CVSS score of 4.6, published 31 August 2026.

Is there a fix for CVE-2026-77353?

A patch was published on 2026-07-11: Fix deployed in version 5.0.0 with iCalendar property value escaping Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77353 attacked?

It is attacked over the network.

Am I affected by CVE-2026-77353?

Check whether you run Ellite Wallos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77353: Wallos CRLF injection in iCalendar export

CVE-2026-77353 · Severity: medium · CVSS 4.6 · Published 2026-08-31

Wallos is a self-hosted subscription tracking application that allows users to export their subscription data as calendar feeds. Prior to version 5.0.0, authenticated users could inject malicious content into shared calendar feeds by embedding newline characters in subscription names or notes. An attacker with a valid account could craft subscriptions that break out of the calendar event structure and insert fake calendar events with spoofed organizers and misleading content, affecting anyone subscribed to that feed.

Technologies: Ellite Wallos. Vendors: Ellite.

Quick answers

Is CVE-2026-77353 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77353 being exploited in the wild.
How severe is CVE-2026-77353?: Medium severity, with a CVSS score of 4.6, published 31 August 2026.
Which products and versions are affected?: Ellite Wallos prior to 5.0.0.
Is there a fix for CVE-2026-77353?: A patch was published on 2026-07-11: Fix deployed in version 5.0.0 with iCalendar property value escaping Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77353 attacked?: It is attacked over the network.
Am I affected by CVE-2026-77353?: Check whether you run Ellite Wallos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a CRLF injection vulnerability in the iCalendar (.ics) export functionality. The root cause is inconsistent encoding: the input validation layer encodes only HTML metacharacters but does not strip or encode newline sequences (CRLF), while the export layer then decodes HTML entities before writing the iCalendar output, allowing embedded CRLF sequences to break out of the VEVENT block. An authenticated attacker can craft a subscription whose name or notes contain raw CRLF sequences, which will then be decoded during export and injected into the .ics feed, allowing insertion of fully attacker-controlled calendar events including arbitrary ATTENDEE properties and organizer information. The vulnerability requires authentication but affects the integrity of exported feeds consumed by calendar applications. The fix was deployed in version 5.0.0 with proper escaping of iCalendar property values.

Affected products

ellite Wallos prior to 5.0.0

Timeline

2026-08-31: disclosed: CVE-2026-77353 published
2026-07-11: patched: Fix deployed in version 5.0.0 with iCalendar property value escaping

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.