CVE-2026-77353 Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export
Authenticated users can inject malicious iCalendar events via CRLF in subscription names, affecting all subscribers to the feed.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-77353?
CVE-2026-77353 is a medium-severity vulnerability in ellite Wallos, published on 31 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input validation layer only encodes HTML metacharacters but never strips newlines, and the export layer decodes those entities back before writing iCal output, an attacker with any valid account can craft a subscription whose name breaks out of the current VEVENT block and inserts fully attacker-controlled calendar events — including spoofed organizers, arbitrary email addresses in ATTENDEE properties, and misleading event content — into any calendar application subscribed to that feed. This issue has been patched in version 5.0.0.
Which versions are affected by CVE-2026-77353?
How do I fix CVE-2026-77353?
No fix has been published for CVE-2026-77353 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-77353 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77353 exists.
Sources
Also known as GHSA-q2r8-m9wm-5547.