A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard… (CVE-2026-88859)
A vulnerability in Evolution allows remote attackers to execute arbitrary JavaScript by sending a crafted HTML email with a spoofed vCard control. When the recipient clicks the control, Evolution's JavaScript handler assigns an attacker-controlled URL to an iframe, bypassing script execution restrictions in email content. This leads to potential arbitrary script execution in the mail-viewing context. The vulnerability requires user interaction and has a medium severity rating with a CVSS score of 5.4. Mitigation involves disabling JavaScript execution in HTML emails via Evolution preferences or gsettings.
AI Analysis
Technical Summary
CVE-2026-88859 is a vulnerability in the Evolution email client where a remote attacker can send a specially crafted HTML email containing a spoofed vCard control. If the victim clicks this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This results in arbitrary JavaScript execution within the mail-viewing context, effectively bypassing security measures designed to prevent script execution in email content. The vulnerability is classified under CWE-84 (Improper Neutralization of Encoded URI Schemes in a Web Page). The CVSS v3.1 base score is 5.4 (medium severity) with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, and low confidentiality and integrity impacts. No official patch is currently referenced in the vendor advisory, but mitigation is available by disabling JavaScript execution in Evolution's HTML mail rendering.
Potential Impact
The vulnerability allows an attacker to execute arbitrary JavaScript code in the context of the Evolution mail client when a user interacts with a maliciously crafted email. This can lead to unauthorized script execution bypassing built-in script restrictions, potentially exposing user data or enabling further attacks within the mail client. The impact on confidentiality and integrity is low, and availability is unaffected. Exploitation requires user interaction (clicking the spoofed vCard control). There are no known exploits in the wild at this time.
Mitigation Recommendations
Users should mitigate this vulnerability by disabling JavaScript execution in HTML emails within Evolution. This can be done through Evolution preferences or by running the command `gsettings set org.gnome.evolution.mail enable-javascript false`. Disabling JavaScript may reduce functionality or rendering quality of some legitimate HTML emails. To revert, run `gsettings set org.gnome.evolution.mail enable-javascript true`. Changes take effect immediately but may require restarting Evolution for full application. No official patch is currently available; users should apply this mitigation until a fix is released.
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard… (CVE-2026-88859)
Description
A vulnerability in Evolution allows remote attackers to execute arbitrary JavaScript by sending a crafted HTML email with a spoofed vCard control. When the recipient clicks the control, Evolution's JavaScript handler assigns an attacker-controlled URL to an iframe, bypassing script execution restrictions in email content. This leads to potential arbitrary script execution in the mail-viewing context. The vulnerability requires user interaction and has a medium severity rating with a CVSS score of 5.4. Mitigation involves disabling JavaScript execution in HTML emails via Evolution preferences or gsettings.
CVSS v3.1
Score 5.4medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-88859 is a vulnerability in the Evolution email client where a remote attacker can send a specially crafted HTML email containing a spoofed vCard control. If the victim clicks this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This results in arbitrary JavaScript execution within the mail-viewing context, effectively bypassing security measures designed to prevent script execution in email content. The vulnerability is classified under CWE-84 (Improper Neutralization of Encoded URI Schemes in a Web Page). The CVSS v3.1 base score is 5.4 (medium severity) with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, and low confidentiality and integrity impacts. No official patch is currently referenced in the vendor advisory, but mitigation is available by disabling JavaScript execution in Evolution's HTML mail rendering.
Potential Impact
The vulnerability allows an attacker to execute arbitrary JavaScript code in the context of the Evolution mail client when a user interacts with a maliciously crafted email. This can lead to unauthorized script execution bypassing built-in script restrictions, potentially exposing user data or enabling further attacks within the mail client. The impact on confidentiality and integrity is low, and availability is unaffected. Exploitation requires user interaction (clicking the spoofed vCard control). There are no known exploits in the wild at this time.
Mitigation Recommendations
Users should mitigate this vulnerability by disabling JavaScript execution in HTML emails within Evolution. This can be done through Evolution preferences or by running the command `gsettings set org.gnome.evolution.mail enable-javascript false`. Disabling JavaScript may reduce functionality or rendering quality of some legitimate HTML emails. To revert, run `gsettings set org.gnome.evolution.mail enable-javascript true`. Changes take effect immediately but may require restarting Evolution for full application. No official patch is currently available; users should apply this mitigation until a fix is released.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8j98-q77q-pmv2
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-88859"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6aa2af49acd9273b49259d63
Added to database: 09/10/2026, 13:23:21 UTC
Last enriched: 09/10/2026, 13:24:44 UTC
Last updated: 09/10/2026, 13:24:44 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.