Arbitrary iCalendar Injection in Wallos Subscription Tracker

CVE-2026-77353

What is CVE-2026-77353?

Wallos, an open-source personal subscription tracker, contains a vulnerability that enables authenticated users to inject arbitrary iCalendar properties into exported .ics feeds. This issue arises because the input validation process only encodes HTML metacharacters but fails to eliminate newline characters. Consequently, an attacker with a valid account could manipulate subscription names or notes to disrupt the VEVENT block within the calendar feed. This allows the insertion of malicious calendar events, which include spoofed organizer details, arbitrary email addresses in the ATTENDEE properties, and misleading event descriptions. A patch addressing this vulnerability is available in version 5.0.0.

References