The icalendar Ruby library incorrectly serializes URI property values in .ics files, allowing an attacker to insert carriage‑return line‑feed characters that terminate the original property and inject new calendar lines. This can result in the addition of arbitrary attendees, modified URLs, alarms, or other calendar fields without the victim’s knowledge. The weakness is a classic input validation failure (CWE‑93).

vulnerable versions of the icalendar gem range from 2.0.0 up to, but not including, 2.12.2. Any Ruby application that employs these versions to generate iCalendar files from partially untrusted input is impacted.

The CVSS score is 4.3, indicating a moderate severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. The most probable attack path involves an application that accepts user‑supplied data, feeds it to icalendar for .ics generation, and then distributes or imports the file in other calendar clients. If successful, the attacker can alter event data but does not obtain arbitrary code execution.