CVE-2026-77353: Wallos iCalendar Feed XSS Vulnerability

CVE-2026-77353 Overview

Wallos is an open-source, self-hostable personal subscription tracker. Versions prior to 5.0.0 allow authenticated users to inject arbitrary iCalendar properties and events into the exported .ics feed. Attackers embed raw carriage return and line feed (CRLF) sequences in subscription names or notes to break out of the current VEVENT block. The flaw is classified as an improper neutralization of special elements in output [CWE-74] issue. The maintainer patched the vulnerability in Wallos version 5.0.0.

Critical Impact
Any authenticated user can inject spoofed calendar events, forged organizers, and arbitrary ATTENDEE email addresses into any calendar application subscribed to the affected .ics feed.

Affected Products

Wallos self-hosted subscription tracker
All Wallos releases prior to version 5.0.0
iCalendar (.ics) feed export functionality

Discovery Timeline

2026-08-31 - CVE-2026-77353 published to the National Vulnerability Database (NVD)
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-77353

Vulnerability Analysis

The vulnerability is an iCalendar injection flaw caused by inconsistent handling of newline characters between the input validation and export layers. Wallos accepts subscription names and notes from authenticated users through its web interface. The input validation layer encodes HTML metacharacters such as <, >, and &, but does not strip or reject carriage return (\r) or line feed (\n) characters.

When the export layer generates the .ics feed, it decodes the previously encoded HTML entities before writing them into the iCal output. Attacker-supplied CRLF sequences pass through untouched and appear as literal line terminators in the calendar payload. Calendar clients parse those lines as new iCal properties.

Root Cause

The root cause is an output-encoding mismatch. HTML entity encoding protects the web interface but does nothing for the iCalendar output context, where line breaks are structural delimiters. Because the export routine reverses the encoding without applying iCal-specific escaping, subscription fields become a full injection primitive into the VCALENDAR document.

Attack Vector

An attacker with any valid Wallos account creates or edits a subscription and inserts CRLF sequences followed by attacker-chosen iCal properties into the name or notes field. When a victim's calendar application fetches the exported .ics feed, the injected content is parsed as legitimate VEVENT blocks. This enables spoofed ORGANIZER values, forged ATTENDEE email entries, and misleading event titles, locations, and descriptions.

Because exploitation requires user interaction from the feed subscriber and a low-privilege authenticated session, the attack is primarily useful for phishing, social engineering, and calendar-based deception.

No public proof-of-concept code is referenced in the advisory. Technical details are available in the GitHub Security Advisory GHSA-q2r8-m9wm-5547 and the remediation commit.

Detection Methods for CVE-2026-77353

Indicators of Compromise

Subscription records in the Wallos database whose name or notes fields contain raw \r\n byte sequences or decoded HTML entities such as and .
Exported .ics feeds containing more BEGIN:VEVENT blocks than there are subscriptions for the account.
Calendar events with ORGANIZER or ATTENDEE values that do not match the Wallos instance's configured user identity.

Detection Strategies

Review the .ics output for each user account and diff the number of VEVENT blocks against the count of active subscriptions.
Scan the subscriptions table for control characters (0x0D, 0x0A) or encoded newline entities in user-controlled text columns.
Inspect web server access logs for POST requests to subscription creation and edit endpoints that carry unusually long or newline-bearing payloads.

Monitoring Recommendations

Enable request-body logging on the reverse proxy in front of Wallos to preserve original payloads for forensic review.
Alert on any downstream calendar client reporting events attributed to organizers outside the expected sender domain.
Track version metadata on the Wallos instance and flag any deployment still running a release earlier than 5.0.0.

How to Mitigate CVE-2026-77353

Immediate Actions Required

Upgrade Wallos to version 5.0.0 or later, which contains the fix from commit 11eaf402e841a628c68a805694227ce66c45f6f3.
Audit existing subscription records for CRLF sequences and sanitize or remove any records that contain injected iCal properties.
Notify users who subscribe to affected .ics feeds and instruct them to remove and re-add the feed after upgrading.

Patch Information

The issue is remediated in Wallos Release v5.0.0. The fix is delivered as part of the release referenced in the GitHub Security Advisory GHSA-q2r8-m9wm-5547. Administrators should validate the upgrade by confirming the running version and re-exporting a test .ics feed to verify that CRLF characters are stripped or escaped.

Workarounds

Restrict Wallos account creation to trusted users only, since exploitation requires an authenticated session.
Disable the .ics export feature at the reverse proxy layer until the upgrade is applied.
Block or rewrite responses from the export endpoint that contain unexpected ORGANIZER, ATTENDEE, or additional BEGIN:VEVENT markers.

bash

# Example reverse-proxy rule to temporarily block .ics export until patched
# nginx configuration snippet
location ~* \.ics$ {
    return 503;
}