CVE-2026-35601

Katalog CVE

CVSS 4.1 · Medium EPSS 0,32%

Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection') pada vikunja. Skor CVSS 3.1 4.1 (Medium) menurut github.com.

Deskripsi (NVD)

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles containing CRLF characters break the iCalendar property boundary, allowing injection of arbitrary iCalendar properties such as ATTACH, VALARM, or ORGANIZER. This vulnerability is fixed in 2.3.0.

Rincian

Terbit di NVD

10 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.1 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2g7h-7rqr-9p4r exploit · advisory vendor
• https://github.com/go-vikunja/vikunja/pull/2580 issue tracking
• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 release notes