Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles containing CRLF characters break the iCalendar property boundary, allowing injection of arbitrary iCalendar properties such as ATTACH, VALARM, or ORGANIZER. This vulnerability is fixed in 2.3.0.
References
| Link | Resource |
|---|---|
| https://github.com/go-vikunja/vikunja/pull/2580 | Issue Tracking |
| https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 | Release Notes |
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2g7h-7rqr-9p4r | Exploit Vendor Advisory |
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2g7h-7rqr-9p4r | Exploit Vendor Advisory |
Configurations
History
17 Apr 2026, 21:56
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Vikunja
Vikunja vikunja |
|
| References | () https://github.com/go-vikunja/vikunja/pull/2580 - Issue Tracking | |
| References | () https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 - Release Notes | |
| References | () https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2g7h-7rqr-9p4r - Exploit, Vendor Advisory | |
| CPE | cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* |
13 Apr 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2g7h-7rqr-9p4r - |
10 Apr 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-10 17:17
Updated : 2026-04-17 21:56
NVD link : CVE-2026-35601
Mitre link : CVE-2026-35601
CVE.ORG link : CVE-2026-35601
JSON object : View
Products Affected
vikunja
- vikunja
CWE
CWE-93
Improper Neutralization of CRLF Sequences ('CRLF Injection')