icalendar

Version	Released
`2.13.0` minor	Oct 11, 2026
`2.12.5` patch	Sep 25, 2026
`2.12.4` patch	Jul 31, 2026
`2.12.3` patch	May 13, 2026
`2.12.2` patch	Mar 21, 2026
`2.12.1` patch 1 CVE	Oct 19, 2025
`2.12.0` minor 1 CVE	Sep 26, 2025
`2.11.2` patch 1 CVE	Jun 21, 2025
`2.11.1` patch 1 CVE	Jun 06, 2025
`2.11.0` minor 1 CVE	Apr 12, 2025
`2.10.3` patch 1 CVE	Sep 21, 2024
`2.10.2` patch 1 CVE	Jul 21, 2024
`2.10.1` patch 1 CVE	Dec 01, 2023
`2.10.0` minor 1 CVE	Nov 01, 2023
`2.9.0` minor 1 CVE	Aug 11, 2023
`2.8.0` minor 1 CVE	Jul 11, 2022
`2.7.1` patch 1 CVE	Mar 15, 2021
`2.7.0` minor 1 CVE	Sep 12, 2020
`2.6.1` patch 1 CVE	Dec 07, 2019
`2.6.0` minor 1 CVE	Nov 27, 2019
`2.5.3` patch 1 CVE	Mar 05, 2019
`2.5.2` patch 1 CVE	Dec 08, 2018
`2.5.1` patch 1 CVE	Oct 30, 2018
`2.5.0` minor 1 CVE	Sep 10, 2018
`2.4.1` patch 1 CVE	Sep 04, 2016
`2.4.0` minor 1 CVE	Jul 05, 2016
`2.3.0` minor 1 CVE	Apr 26, 2015
`2.2.2` patch 1 CVE	Dec 27, 2014
`2.2.1` patch 1 CVE	Dec 04, 2014
`2.2.0` minor 1 CVE	Sep 24, 2014
`2.1.2` patch 1 CVE	Sep 10, 2014
`2.1.1` patch 1 CVE	Jul 24, 2014
`2.1.0` minor 1 CVE	Jun 17, 2014
`2.0.1` patch 1 CVE	Apr 27, 2014
`1.5.4` patch	Apr 27, 2014
`2.0.0` major 1 CVE	Apr 23, 2014
`1.5.3` patch	Apr 20, 2014
`2.0.0.beta.2` pre	Apr 11, 2014
`2.0.0.beta.1` pre	Mar 30, 2014
`1.5.2` patch	Mar 22, 2014
`1.5.1` patch	Feb 28, 2014
`1.5.0` minor	Dec 07, 2013
`1.4.5` patch	Nov 14, 2013
`1.4.4` patch	Nov 06, 2013
`1.4.3` patch	Sep 18, 2013
`1.4.2` patch	Sep 11, 2013
`1.4.1` patch	Jun 26, 2013
`1.4.0` minor	May 21, 2013
`1.3.0` minor	Apr 01, 2013
`1.2.4` patch	Mar 27, 2013

2.13.0 minor

Oct 11, 2026

2.12.5 patch

Sep 25, 2026

2.12.4 patch

Jul 31, 2026

2.12.3 patch

May 13, 2026

2.12.2 patch

Mar 21, 2026

2.12.1 patch

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Oct 19, 2025

2.12.0 minor

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Sep 26, 2025

2.11.2 patch

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Jun 21, 2025

2.11.1 patch

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Jun 06, 2025

2.11.0 minor

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Apr 12, 2025

2.10.3 patch

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Sep 21, 2024

2.10.2 patch

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Jul 21, 2024

2.10.1 patch

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Dec 01, 2023

2.10.0 minor

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Nov 01, 2023

2.9.0 minor

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Aug 11, 2023

2.8.0 minor

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Jul 11, 2022

2.7.1 patch

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Mar 15, 2021

2.7.0 minor

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Sep 12, 2020

2.6.1 patch

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Dec 07, 2019

2.6.0 minor

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Nov 27, 2019

2.5.3 patch

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Mar 05, 2019

2.5.2 patch

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Dec 08, 2018

2.5.1 patch

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Oct 30, 2018

2.5.0 minor

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Sep 10, 2018

2.4.1 patch

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Sep 04, 2016

2.4.0 minor

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Jul 05, 2016

2.3.0 minor

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Apr 26, 2015

2.2.2 patch

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Dec 27, 2014

2.2.1 patch

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Dec 04, 2014

2.2.0 minor

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Sep 24, 2014

2.1.2 patch

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Sep 10, 2014

2.1.1 patch

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Jul 24, 2014

2.1.0 minor

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Jun 17, 2014

2.0.1 patch

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Apr 27, 2014

1.5.4 patch

Apr 27, 2014

2.0.0 major

1 CVE

CVE-2026-33635 GHSA-pv9c-9mfh-hvxq Mar 24, 2026

iCalendar has ICS injection via unsanitized URI property values

4.3 / 10

Medium

Network Low None Required Unchanged None Low None

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Affected versions


          2.0.0


          2.0.1


          2.1.0


          2.1.1


          2.1.2


          2.10.0


          2.10.1


          2.10.2


          2.10.3


          2.11.0


          2.11.1


          2.11.2

+ 18 more


            2.12.0


            2.12.1


            2.2.0


            2.2.1


            2.2.2


            2.3.0


            2.4.0


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.6.0


            2.6.1


            2.7.0


            2.7.1


            2.8.0


            2.9.0

Fixed in


          2.12.2

References

Updated Mar 27, 2026 · Source: OSV.dev

Apr 23, 2014

1.5.3 patch

Apr 20, 2014

2.0.0.beta.2 pre

Apr 11, 2014

2.0.0.beta.1 pre

Mar 30, 2014

1.5.2 patch

Mar 22, 2014

1.5.1 patch

Feb 28, 2014

1.5.0 minor

Dec 07, 2013

1.4.5 patch

Nov 14, 2013

1.4.4 patch

Nov 06, 2013

1.4.3 patch

Sep 18, 2013

1.4.2 patch

Sep 11, 2013

1.4.1 patch

Jun 26, 2013

1.4.0 minor

May 21, 2013

1.3.0 minor

Apr 01, 2013

1.2.4 patch

Mar 27, 2013

Activity

Reach

Details