All issues

Search results

[Security] CRLF Content-Line Injection in ical.js URI Serialization

Status: Open.

#1042 In kewisch/ical.js;

· 0hyeon15 opened on Sep 25, 2026

Date/time value conversions don't validate, so malformed input yields plausible but wrong values instead of an error

Status: Open.

#1041 In kewisch/ical.js;

· mkmelin opened on Sep 24, 2026

BYSETPOS is ignored except on two rule shapes, and numbered per month on yearly rules

Status: Open.

#1039 In kewisch/ical.js;

· mkmelin opened on Sep 23, 2026

RecurIterator#next never returns when the contracting BY* parts cannot all be satisfied

Status: Open.

#1038 In kewisch/ical.js;

· mkmelin opened on Sep 23, 2026

FREQ=YEARLY drops the instances BYHOUR, BYMINUTE and BYSECOND expand to

Status: Open.

#1037 In kewisch/ical.js;

· mkmelin opened on Sep 23, 2026

vCard 4.0 REV timestamp in the extended format is mangled into an invalid value

Status: Open.

#1028 In kewisch/ical.js;

· mkmelin opened on Sep 16, 2026

Event iterator emits an occurrence twice when RRULE and RDATE coincide

Status: Open.

#1026 In kewisch/ical.js;

· sinagkh opened on Sep 13, 2026

ICAL.parse sometimes returns mangled property values

Status: Open.

#1020 In kewisch/ical.js;

· lathrys-at opened on Aug 22, 2026

strictExceptions doesn't filter cross-UID exceptions — it throws, and the default silently cross-wires them

Status: Open.

#1019 In kewisch/ical.js;

· mplabs opened on Aug 20, 2026

Parser aborts the whole calendar import on one malformed parameter

Status: Open.

#1015 In kewisch/ical.js;

· bmarinov opened on Aug 11, 2026

ICAL.Recur.toString()/toJSON() drop RSCALE, SKIP and other unknown RRULE parts

Status: Open.

#1001 In kewisch/ical.js;

· spokodev opened on Jun 18, 2026

Bug in BYSETPOS

Status: Open.

#960 In kewisch/ical.js;

· woldaker opened on Feb 8, 2026