Vikunja relied on raw string concatenation when building iCalendar VTODO entries for CalDAV output. A title containing CRLF characters can break the iCalendar property boundary, making it possible to inject arbitrary properties such as ATTACH, VALARM, or ORGANIZER. The vulnerability enables an attacker to embed malicious iCalendar content, potentially leading to the execution of arbitrary attachments or manipulation of calendar data. While the injection does not immediately grant code execution on the host, it can compromise data integrity and could be leveraged in downstream applications to deliver malware.

The open-source self‑hosted task management platform Vikunja (go‑vikunja:vikunja) is affected. All releases prior to version 2.3.0 build CalDAV feeds without proper escaping and are vulnerable.

The CVSS score of 4.1 indicates moderate severity. EPSS information is not available, and the issue is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by creating or modifying a task title with CRLF characters, which any client fetching the CalDAV feed can trigger. Because the vulnerability is present in every install before 2.3.0, the risk is widespread as long as the legacy version remains in use.