CVE-2026-88859: Improper Neutralization of Encoded URI Schemes in a Web Page in Red Hat Red Hat Enterprise Linux 6
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.
AI Analysis
Technical Summary
This vulnerability in Evolution involves improper neutralization of encoded URI schemes in a web page context. An attacker can send a specially crafted HTML email containing a spoofed vCard control. When the victim clicks the control, Evolution's trusted JavaScript handler incorrectly sets an attacker-controlled JavaScript URL as the source of an iframe, enabling arbitrary JavaScript execution within the mail-viewing context. This bypasses security measures designed to prevent script execution in email content. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity).
Potential Impact
The vulnerability allows remote attackers to execute arbitrary JavaScript in the context of the mail viewer in Evolution, potentially leading to limited confidentiality and integrity impacts. This could enable actions such as spoofing or manipulation of email content within the mail client. There is no impact on availability. Exploitation requires user interaction (clicking the spoofed vCard control). No known exploits in the wild have been reported.
Mitigation Recommendations
Red Hat advises users to mitigate this vulnerability by disabling JavaScript execution for HTML mail in Evolution. This can be done via Evolution preferences or by running the command `gsettings set org.gnome.evolution.mail enable-javascript false`. Disabling JavaScript may reduce functionality or rendering quality of some legitimate HTML emails. No official patch or fix has been confirmed as of the advisory date. Users should monitor the Red Hat advisory page for updates and consider applying this mitigation until a fix is available.
CVE-2026-88859: Improper Neutralization of Encoded URI Schemes in a Web Page in Red Hat Red Hat Enterprise Linux 6
Description
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.
CVSS v3.1
Score 5.4medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Evolution involves improper neutralization of encoded URI schemes in a web page context. An attacker can send a specially crafted HTML email containing a spoofed vCard control. When the victim clicks the control, Evolution's trusted JavaScript handler incorrectly sets an attacker-controlled JavaScript URL as the source of an iframe, enabling arbitrary JavaScript execution within the mail-viewing context. This bypasses security measures designed to prevent script execution in email content. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity).
Potential Impact
The vulnerability allows remote attackers to execute arbitrary JavaScript in the context of the mail viewer in Evolution, potentially leading to limited confidentiality and integrity impacts. This could enable actions such as spoofing or manipulation of email content within the mail client. There is no impact on availability. Exploitation requires user interaction (clicking the spoofed vCard control). No known exploits in the wild have been reported.
Mitigation Recommendations
Red Hat advises users to mitigate this vulnerability by disabling JavaScript execution for HTML mail in Evolution. This can be done via Evolution preferences or by running the command `gsettings set org.gnome.evolution.mail enable-javascript false`. Disabling JavaScript may reduce functionality or rendering quality of some legitimate HTML emails. No official patch or fix has been confirmed as of the advisory date. Users should monitor the Red Hat advisory page for updates and consider applying this mitigation until a fix is available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-09-10T10:42:51.932Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-88859","vendor":"Red Hat"}]
Threat ID: 6aa29692acd9273b490be64c
Added to database: 09/10/2026, 11:37:54 UTC
Last enriched: 09/10/2026, 11:52:51 UTC
Last updated: 09/10/2026, 12:03:35 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.