CVE-2026-33635: 
Ruby vulnerability analysis and mitigation

CVE-2026-33635 is an ICS injection vulnerability in the icalendar Ruby gem caused by improper sanitization of URI property values during .ics file serialization. It affects versions 2.0.0 through 2.12.1 of the icalendar RubyGems package. The vulnerability was disclosed on March 21, 2026, by researcher WesR via a GitHub Security Advisory, and was published to the National Vulnerability Database on March 26, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory).

The root cause is CWE-93 (Improper Neutralization of CRLF Sequences). In lib/icalendar/values/uri.rb, the Icalendar::Values::Uri class falls back to the raw input string when URI.parse fails, and subsequently serializes it via value.to_s without stripping or encoding \r or \n characters. Because ICS content lines are delimited by CRLF sequences, an attacker-controlled URI value containing \r\n can terminate the current property line and inject arbitrary new ICS properties or components. Vulnerable properties include url, source, image, organizer, attach, attendee, conference, and tzurl. The fix (commit b8d23b4) percent-encodes all ASCII control bytes (0x00–0x1F and 0x7F) in the value_ical method using a regex substitution (GitHub Advisory, Patch Commit).

Exploitation allows an attacker to inject arbitrary calendar properties or components into generated .ics files, compromising data integrity for downstream calendar clients or importers. Potential injected content includes fabricated attendees, modified event URLs, malicious alarms, or altered organizer fields — all processed as legitimate event data by calendar applications. There is no confidentiality or availability impact; the scope is limited to integrity of the generated ICS output and the trust placed in it by calendar consumers (GitHub Advisory).

No active in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A proof-of-concept is publicly available in the GitHub Security Advisory, though it only demonstrates the flaw locally and requires a real application using the library to be exploitable against end users. The EPSS score is approximately 0.028% (0.000280), placing it in the 16th percentile for exploitation likelihood. No threat actor attribution has been identified (GitHub Advisory).

1. Identify a target application: Find a Ruby web application that uses the icalendar gem (versions 2.0.0–2.12.1) to generate .ics files from user-supplied or partially untrusted input (e.g., event URLs, organizer fields, attendee addresses).
2. Craft a malicious URI payload: Construct a URI string containing an embedded CRLF sequence followed by the desired injected ICS property, for example: https://a.example/ok\r\nATTENDEE:mailto:evil@example.com.
3. Submit the payload: Supply the malicious URI as input to any field the application passes to a URI-typed ICS property (e.g., url, organizer, attendee, attach, conference, tzurl, source, or image).
4. Trigger ICS generation: Cause the application to serialize the calendar event to an .ics file or response, embedding the unsanitized URI value directly into the ICS content line.
5. Deliver to victim: The generated .ics file now contains the injected property. When a victim imports or processes the file in a calendar client, the injected content (e.g., a fake attendee, alarm, or URL) is interpreted as legitimate event data (GitHub Advisory).

• File System: Generated .ics files containing unexpected properties such as additional ATTENDEE, ORGANIZER, ALARM, or URL lines not present in the original event data; ICS files with percent-encoded control characters (%0D%0A) in URI fields (post-patch behavior) versus raw CRLF in pre-patch files.
• Logs: Application logs showing user-supplied input containing literal \r\n or URL-encoded %0D%0A sequences in URI-type fields; unexpected calendar property names appearing in serialized ICS output logged by the application.
• Network: Outbound calendar invitations or .ics attachments sent to unexpected email addresses (e.g., evil@example.com) that were not part of the original event configuration.

Upgrade the icalendar RubyGem to version 2.12.2 or later, which percent-encodes all ASCII control bytes (including \r and \n) in URI-typed values before serialization (GitHub Advisory, Patch Commit). As a short-term workaround for applications that cannot immediately upgrade, sanitize all user-supplied URI inputs by stripping or rejecting raw CR (\r) and LF (\n) characters before passing them to the library. Applications that do not generate .ics files from untrusted input are not affected.