Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input validation layer only encodes HTML metacharacters but never strips newlines, and the export layer decodes those entities back before writing iCal output, an attacker with any valid account can craft a subscription whose name breaks out of the current VEVENT block and inserts fully attacker-controlled calendar events — including spoofed organizers, arbitrary email addresses in ATTENDEE properties, and misleading event content — into any calendar application subscribed to that feed. This issue has been patched in version 5.0.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-08-31T22:17:20.743Z",
  "pubdate": "2026-08-31T22:17:20.743Z",
  "executiveSummary": "Wallos versions prior to 5.0.0 are susceptible to an iCalendar Injection vulnerability resulting from improper neutralization of newline characters during data processing. This flaw allows authenticated users to manipulate exported .ics feeds by embedding CRLF sequences into subscription metadata.\nThe vulnerability enables an attacker to perform a 'calendar injection' attack, allowing them to breakout of legitimate VEVENT structures. By injecting arbitrary iCalendar properties, an attacker can influence downstream calendar applications that ingest the feed. Potential impacts include the spoofing of event organizers, insertion of fraudulent ATTENDEE entries, and the propagation of malicious or misleading event data to any user or system subscribing to the affected feed.\nExploitation requires a valid user account, as the attacker must be able to create or modify subscription records within the application. Once injected, the payload is triggered whenever the target calendar client parses the exported .ics file. The vulnerability presents a risk of social engineering, phishing, or unauthorized calendar content manipulation.\nThe issue has been remediated in version 5.0.0, which effectively handles CRLF sequences during the export process.",
  "technicalDetails": "The root cause of this vulnerability lies in an asymmetric validation and encoding logic between the input storage layer and the iCalendar export routine. Wallos sanitizes user-supplied input—specifically within subscription names and notes—by encoding HTML metacharacters. However, this validation routine fails to filter or escape carriage return (\\r) and line feed (\\n) characters.\nThe iCalendar (RFC 5545) format relies on specific line breaks (CRLF) to delimit properties within a VEVENT object. When the application generates the exported .ics file, the export layer decodes the previously escaped HTML entities back into their raw form. Because the original input containing raw newline characters was never stripped, these characters remain present in the final output stream.\nAn attacker can exploit this by crafting a subscription name containing a CRLF sequence followed by valid iCalendar syntax. For example, a subscription name could be crafted as: 'SubscriptionName\\r\\nSUMMARY:Malicious Event\\r\\nDESCRIPTION:Phishing Link'. When the .ics file is parsed by a calendar application, the parser interprets the injected CRLF as the termination of the current property and the beginning of a new property or event block.\nThe attack flow follows these steps: 1) The attacker authenticates to a valid Wallos account. 2) The attacker creates or modifies a subscription, populating the 'name' or 'note' fields with an iCalendar injection payload containing CRLF sequences. 3) The attacker triggers the iCalendar export feature. 4) The application generates an .ics file where the attacker's payload is rendered as raw iCalendar directives rather than as literal text within the subscription properties. 5) A target calendar client consumes the feed, causing the injected directives to be processed as legitimate events, potentially overwriting existing entries, spoofing attendees, or altering the perceived scheduling metadata.\nThis vulnerability is particularly dangerous as it allows for the manipulation of remote calendar clients, which often implicitly trust the content provided by subscription feeds. Because the injection occurs at the serialization layer, the output bypasses basic context-aware sanitization that might otherwise be applied to a web interface. Impact includes the corruption of the user's calendar data, the potential for phishing via malicious event descriptions, and the ability to associate the victim's calendar with arbitrary email addresses in the ATTENDEE field."
}