EUVD-2026-290876

fkie_cve-2026-35601

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles containing CRLF characters break the iCalendar property boundary, allowing injection of arbitrary iCalendar properties such as ATTACH, VALARM, or ORGANIZER. This vulnerability is fixed in 2.3.0.

GHSA-2g7h-7rqr-9p4r — Vikunja has iCalendar Property Injection via CRLF in CalDAV Task Output

Affected: Go: code.vikunja.io/api

## Summary

The CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles containing CRLF characters break the iCalendar property boundary, allowing injection of arbitrary iCalendar properties such as `ATTACH`, `VALARM`, or `ORGANIZER`.

## Details

The `ParseTodos` function at `pkg/caldav/caldav.go:146` concatenates the task summary directly into the iCalendar output:

```go SUMMARY:` + t.Summary + getCaldavColor(t.Color) ```

RFC 5545 Section 3.3.11 requires TEXT property values to escape newlines as `\n`, semicolons as `\;`, commas as `\,`, and backslashes as `\\`. None of these escaping rules are applied to `Summary`, `Categories`, `UID`, project name, or alarm `Description` fields.

Go's JSON decoder preserves literal CR/LF bytes in string values, so task titles created via the REST API retain CRLF characters. When these tasks are served via CalDAV, the newlines break the `SUMMARY` property and the subsequent text is parsed by CalDAV clients as independent iCalendar properties.

## Proof of Concept

Tested on Vikunja v2.2.2.

```python import requests from requests.auth import HTTPBasicAuth

TARGET = "http://localhost:3456" API = f"{TARGET}/api/v1"

token = requests.post(f"{API}/login", json={"username": "alice", "password": "Alice1234!"}).json()["token"] h = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}

proj = requests.put(f"{API}/project…

Most recent entries from all

EUVD-2026-290876

fkie_cve-2026-35601

GHSA-2g7h-7rqr-9p4r — Vikunja has iCalendar Property Injection via CRLF in CalDAV Task Output