RubyGems/icalendar CVE-2026-33635: medium 4.3, EPSS 0.39%

iCalendar has ICS injection via unsanitized URI property values

Action: Upgrade icalendar to 2.12.2 or later.

bundle update icalendar

Affected

Fixed versions

Sources

• osv: GHSA-pv9c-9mfh-hvxq
• https://github.com/icalendar/icalendar/security/advisories/GHSA-pv9c-9mfh-hvxq
• https://nvd.nist.gov/vuln/detail/CVE-2026-33635
• https://github.com/icalendar/icalendar/commit/b8d23b490363ee5fffaec1d269a8618a912ca265
• https://github.com/icalendar/icalendar
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/icalendar/CVE-2026-33635.yml

CVE-2026-33635 · published 2026-03-24T19:13:41Z · modified 2026-03-27T22:17:39.528683Z · JSON