CVE-2026-35601 go-vikunja CVE debrief

Who should care

Defenders responsible for Vikunja instances, especially those with user-controlled task titles, should assess exposure and prioritize updating to version 2.3.0 or later. This includes reviewing and sanitizing user-controlled task titles for potential CRLF characters and monitoring for suspicious iCalendar property activity. Additionally, defenders should verify and update Vikunja instances to version 2.3.0 or later, and review compensating controls for

Why it matters

CVE-2026-35601 is a medium-severity vulnerability in Vikunja that allows injection of arbitrary iCalendar properties due to improper escaping of user-controlled task titles. Defenders should prioritize verifying and updating Vikunja instances to version 2.3.0 or later, especially those with user-controlled task titles, to prevent potential disruption of calendar functionality and unintended changes to calendar events.

• Potential injection of arbitrary iCalendar properties
• Possible disruption of calendar functionality
• Risk of unintended changes to calendar events
• Need for verification of user-controlled task titles

Technical summary

The CalDAV output generator in Vikunja builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. This allows user-controlled task titles containing CRLF characters to break the iCalendar property boundary, enabling injection of arbitrary iCalendar properties such as ATTACH, VALARM, or ORGANIZER. The vulnerability is caused by the lack of proper escaping of user-controlled input, which can lead to potential disruption of calendar functionality and unintended changes to calendar events. User-controlled task titles are not properly sanitized, allowing an attacker to inject arbitrary iCalendar properties.

Defensive priority

Defenders should prioritize verifying and updating Vikunja instances to version 2.3.0 or later, especially those with user-controlled task titles.

Recommended defensive actions

• Verify and update Vikunja instances to version 2.3.0 or later
• Review and sanitize user-controlled task titles for potential CRLF characters
• Monitor for suspicious iCalendar property activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by raw string concatenation without applying RFC 5545 TEXT value escaping in the CalDAV output generator. User-controlled task titles containing CRLF characters can break the iCalendar property boundary, allowing injection of arbitrary iCalendar properties.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.