iCalendar is a Ruby library for dealing with iCalendar files in the iCalendar format defined by RFC-5545. Starting in version 2.0.0 and prior to version 2.12.2, .ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output. `Icalendar::Values::Uri` falls back to the raw input string when `URI.parse` fails and later serializes it with `value.to_s` without removing or escaping `\r` or `\n` characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this). Applications that generate `.ics` files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields. Version 2.12.2 contains a patch for the issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - iCalendar is a Ruby library for dealing with iCalendar files in the iCalendar format defined by RFC-5545.
    Starting in version 2.0.0 and prior to version 2.12.2, .ics serialization does not properly sanitize URI     property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines     to the output. `Icalendar::Values::Uri` falls back to the raw input string when `URI.parse` fails and     later serializes it with `value.to_s` without removing or escaping `\r` or `\n` characters. That value is     embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can     terminate the original property and create a new ICS property or component. (It looks like you can inject     via url, source, image, organizer, attach, attendee, conference, tzurl because of this). Applications that     generate `.ics` files from partially untrusted metadata are impacted. As a result, downstream calendar     clients or importers may process attacker-supplied content as if it were legitimate event data, such as     added attendees, modified URLs, alarms, or other calendar fields. Version 2.12.2 contains a patch for the     issue. (CVE-2026-33635)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - iCalendar is a Ruby library for dealing with iCalendar files in the iCalendar format defined by RFC-5545.
    Starting in version 2.0.0 and prior to version 2.12.2, .ics serialization does not properly sanitize URI
    property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines
    to the output. `Icalendar::Values::Uri` falls back to the raw input string when `URI.parse` fails and
    later serializes it with `value.to_s` without removing or escaping `\r` or `\n` characters. That value is
    embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can
    terminate the original property and create a new ICS property or component. (It looks like you can inject
    via url, source, image, organizer, attach, attendee, conference, tzurl because of this). Applications that
    generate `.ics` files from partially untrusted metadata are impacted. As a result, downstream calendar
    clients or importers may process attacker-supplied content as if it were legitimate event data, such as
    added attendees, modified URLs, alarms, or other calendar fields. Version 2.12.2 contains a patch for the
    issue. (CVE-2026-33635)

ID	Name	Product	Family	Type	Severity
304171	Linux Distros Unpatched Vulnerability : CVE-2026-33635	Nessus	Misc.	Local	medium
439177	SCA: security update for icalendar (GHSA-pv9c-9mfh-hvxq)	Tenable Cloud Security	SCA Checks	Local	medium
439177	SCA: security update for icalendar (GHSA-pv9c-9mfh-hvxq)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-33635

medium

Tenable Plugins

medium

medium

medium