CVE-2026-88859
Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in Evolution Email Client via Spoofed vCard

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: redhat-SADP

Description
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-30
AI Q&A
2026-09-10
EPSS Evaluated
2026-09-29
NVD
CVE-2026-88859
EUVD
EUVD-2026-75397

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gnome evolution to 2.11.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-84 The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Evolution allows a remote attacker to send a specially crafted HTML email with a spoofed vCard control. When clicked, it tricks Evolution into executing arbitrary JavaScript within the email viewer by assigning an attacker-controlled URL to an iframe's source, bypassing security restrictions on script execution in emails.

Detection Guidance

This vulnerability is specific to the Evolution email client and requires checking if JavaScript is enabled for HTML emails. You can verify this by inspecting Evolution's settings or running the command `gsettings get org.gnome.evolution.mail enable-javascript` to check the current JavaScript status.

Impact Analysis

An attacker could exploit this to run malicious scripts when you view a crafted email, potentially stealing sensitive data, installing malware, or taking control of your email session. It requires you to click the spoofed vCard control for the attack to succeed.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized script execution in email content. Attackers could exploit it to access sensitive data or perform actions on behalf of users, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Disable JavaScript execution for HTML mail in Evolution by using the Evolution preferences or running the command `gsettings set org.gnome.evolution.mail enable-javascript false`. Note that this may affect the rendering and functionality of some legitimate HTML emails.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88859. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart