CVE-2026-77353: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in ellite Wallos
Description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input validation layer only encodes HTML metacharacters but never strips newlines, and the export layer decodes those entities back before writing iCal output, an attacker with any valid account can craft a subscription whose name breaks out of the current VEVENT block and inserts fully attacker-controlled calendar events — including spoofed organizers, arbitrary email addresses in ATTENDEE properties, and misleading event content — into any calendar application subscribed to that feed. This issue has been patched in version 5.0.0.
CVSS v3.1
Score 4.6medium
Affected software
ellite
Wallos
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Wallos versions before 5.0.0 allow authenticated users to perform injection attacks on exported iCalendar (.ics) feeds by embedding raw CRLF sequences in subscription names or notes. The input validation layer encodes HTML metacharacters but fails to strip newline characters, and the export layer decodes these entities back before generating the iCal output. This flaw enables attackers to break out of the current VEVENT block and insert fully attacker-controlled calendar events, including spoofed organizers and arbitrary email addresses in ATTENDEE properties. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-116 (Improper Encoding or Escaping of Output). It has been patched in Wallos version 5.0.0.
Potential Impact
An attacker with any valid account can inject arbitrary calendar events into the exported .ics feed, potentially misleading users of calendar applications subscribed to that feed. This can result in spoofed event organizers, arbitrary email addresses in attendee fields, and misleading event content. The confidentiality and integrity of calendar data are impacted, but there is no indication of availability impact. The CVSS v3.1 base score is 4.6 (medium severity), reflecting low complexity and limited privileges required but user interaction needed.
Mitigation Recommendations
This vulnerability has been patched in Wallos version 5.0.0. Users and administrators should upgrade to version 5.0.0 or later to remediate this issue. No other mitigation or temporary workaround is indicated in the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-20T19:28:35.244Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a95f425acd9273b499e7703
Added to database: 08/31/2026, 21:37:41 UTC
Last enriched: 09/07/2026, 12:56:27 UTC
Last updated: 10/15/2026, 06:48:18 UTC
Views: 82
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.