CVE-2026-77353

Received Received - Intake

CRLF Injection in Wallos Subscription Export

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input validation layer only encodes HTML metacharacters but never strips newlines, and the export layer decodes those entities back before writing iCal output, an attacker with any valid account can craft a subscription whose name breaks out of the current VEVENT block and inserts fully attacker-controlled calendar events — including spoofed organizers, arbitrary email addresses in ATTENDEE properties, and misleading event content — into any calendar application subscribed to that feed. This issue has been patched in version 5.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-77353

Affected Vendors & Products

Vendor	Product	Version / Range
wallos	wallos	to 5.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

Wallos before version 5.0.0 allows authenticated users to inject arbitrary iCalendar properties and events into exported .ics feeds by embedding CRLF sequences in subscription names or notes. The input validation only encodes HTML metacharacters but does not strip newlines, allowing attackers to break out of VEVENT blocks and insert malicious calendar events.

Detection Guidance

Check Wallos instances for version below 5.0.0. Inspect .ics export feeds for CRLF sequences in subscription names or notes. Look for unexpected calendar events in subscribed applications.

Impact Analysis

An attacker with a valid account could inject spoofed events into your calendar feed, including misleading event details, fake organizers, or malicious attendee email addresses. This could lead to phishing attempts, misinformation, or unauthorized event manipulation in your calendar application.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized data exposure or manipulation through crafted calendar events. Attackers may inject misleading or spoofed event content, including email addresses, which could lead to data breaches or privacy violations if exploited.

Mitigation Strategies

Upgrade Wallos to version 5.0.0 or later immediately. Review user subscriptions for suspicious names or notes containing CRLF sequences. Audit exported .ics feeds for unauthorized events.

Hi! I’m here to help you understand CVE-2026-77353. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70