krzysiek
Thanks for highlighting this issue - if you change line 228 of components/com_jevents/controllers/icals.php from
$years = explode(",", $input->getCmd('years', ''));
to
// already fetched and sanitised
$years = explode(",", $years);
it will resolve this issue.
The correction will be in version 3.6.6