{"action":"Upgrade icalendar to 2.12.2 or later.","affected":[{"fixed":"2.12.2","introduced":"2.0.0"}],"component":"icalendar","cve_ids":["CVE-2026-33635"],"ecosystem":"RubyGems","epss":0.00388,"exploited":false,"fixed_versions":["2.12.2"],"ghsa_id":"GHSA-pv9c-9mfh-hvxq","id":"tcs_01M5KEMQ4EB643EB3XHMCRBTQR","modified_at":"2026-03-27T22:17:39.528683Z","published_at":"2026-03-24T19:13:41Z","references":["https://osv.dev/vulnerability/GHSA-pv9c-9mfh-hvxq","https://github.com/icalendar/icalendar/security/advisories/GHSA-pv9c-9mfh-hvxq","https://nvd.nist.gov/vuln/detail/CVE-2026-33635","https://github.com/icalendar/icalendar/commit/b8d23b490363ee5fffaec1d269a8618a912ca265","https://github.com/icalendar/icalendar","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/icalendar/CVE-2026-33635.yml"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-pv9c-9mfh-hvxq","url":"https://osv.dev/vulnerability/GHSA-pv9c-9mfh-hvxq"}],"summary":"iCalendar has ICS injection via unsanitized URI property values"}