Updated advisory posts against rubysec/ruby-advisory-db@aa2bacb

Author: jasnow

advisories/_posts/2026-03-24-CVE-2026-33635.md

@@ -0,0 +1,59 @@
+---
+layout: advisory
+title: 'CVE-2026-33635 (icalendar): iCalendar has ICS injection via unsanitized URI
+  property values'
+comments: false
+categories:
+- icalendar
+advisory:
+  gem: icalendar
+  cve: 2026-33635
+  ghsa: pv9c-9mfh-hvxq
+  url: https://github.com/icalendar/icalendar/security/advisories/GHSA-pv9c-9mfh-hvxq
+  title: iCalendar has ICS injection via unsanitized URI property values
+  date: 2026-03-24
+  description: |
+    ### Summary
+
+    .ics serialization does not properly sanitize URI property values,
+    enabling ICS injection through attacker-controlled input, adding
+    arbitrary calendar lines to the output.
+
+    ### Details
+
+    `Icalendar::Values::Uri` falls back to the raw input string when
+    `URI.parse` fails and later serializes it with `value.to_s` without
+    removing or escaping `\r` or `\n` characters. That value is embedded
+    directly into the final ICS line by the normal serializer, so a
+    payload containing CRLF can terminate the original property and
+    create a new ICS property or component. (It looks like you can
+    inject via url, source, image, organizer, attach, attendee,
+    conference, tzurl because of this)
+
+    Relevant code:
+    - `lib/icalendar/values/uri.rb:16`
+
+    ### Impact
+
+    Applications that generate `.ics` files from partially untrusted
+    metadata are impacted. As a result, downstream calendar clients
+    or importers may process attacker-supplied content as if it were
+    legitimate event data, such as added attendees, modified URLs,
+    alarms, or other calendar fields.
+
+    ## Fix
+
+    Reject raw CR and LF characters in `URI`-typed values before
+    serialization, or escape/encode them so they cannot terminate
+    the current ICS content line.
+  cvss_v3: 4.3
+  unaffected_versions:
+  - "< 2.0.0"
+  patched_versions:
+  - ">= 2.12.2"
+  related:
+    url:
+    - https://github.com/icalendar/icalendar/security/advisories/GHSA-pv9c-9mfh-hvxq
+    - https://github.com/icalendar/icalendar/commit/b8d23b490363ee5fffaec1d269a8618a912ca265
+    - https://github.com/advisories/GHSA-pv9c-9mfh-hvxq
+---