CVE-2026-88859
Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.
- Record
CVE-2026-88859- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-84
- Updated
- 2026-11-06
EUVDEUVD-2026-75397
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.
- Record
EUVD-2026-75397- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-8j98-q77q-pmv2
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a...
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.
- Record
GHSA-8j98-q77q-pmv2- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-84
- Updated
- 2026-11-02
NVD
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.
- Record
CVE-2026-88859- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-84
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-88859
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.
- Record
DEBIAN-CVE-2026-88859- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-88859
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.
- Record
UBUNTU-CVE-2026-88859- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVMGASA-2026-0554 No score
Updated evolution package fixes a security vulnerability
Javascript execution via spoofed vcard control bypasses mail script-markup restriction. (CVE-2026-88859)
- Record
MGASA-2026-0554- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
evolutionDebian:12 |
All versions, plus listed versions 3.46.4-23.46.4-2+deb12u13.47.2-13.47.3-13.48.0-1 Show 45 moreShow less3.48.1-13.48.2-13.48.3-13.48.4-13.49.2-13.49.2-23.49.2-33.49.3-13.50.0-13.50.1-13.50.2-13.50.3-13.51.2-13.52.0-13.52.1-13.52.1-23.52.1-33.52.1-43.52.2-13.52.2-23.52.3-13.53.2-13.53.3-13.54.0-13.54.1-13.54.2-13.54.3-13.54.3-23.55.1-13.55.1-23.55.2-13.55.3-13.56.0-13.56.1-13.56.2-13.56.2-103.56.2-23.56.2-33.56.2-43.56.2-53.56.2-73.56.2-83.56.2-93.62.0-13.62.1-1 |
None known |
evolutionDebian:13 |
All versions, plus listed versions 3.56.1-13.56.1-1+deb13u13.56.2-0+deb13u13.56.2-13.56.2-10 Show 11 moreShow less3.56.2-23.56.2-33.56.2-43.56.2-53.56.2-73.56.2-83.56.2-93.62.0-13.62.1-13.62.1-23.62.1-3 |
None known |
evolutionDebian:14 |
All versions, plus listed versions 3.56.1-13.56.2-13.56.2-103.56.2-23.56.2-3 Show 9 moreShow less3.56.2-43.56.2-53.56.2-73.56.2-83.56.2-93.62.0-13.62.1-13.62.1-23.62.1-3 |
None known |
evolutionMageia:10 |
before 3.58.2-1.1.mga10 | 3.58.2-1.1.mga10 |
evolutionUbuntu:16.04:LTS |
All versions, plus listed versions 3.16.5-1ubuntu33.18.1-1ubuntu23.18.2-0ubuntu13.18.2-0ubuntu23.18.3-0ubuntu1 Show 8 moreShow less3.18.3-1ubuntu13.18.4-0ubuntu13.18.5-1ubuntu13.18.5.1-1ubuntu13.18.5.2-0ubuntu13.18.5.2-0ubuntu33.18.5.2-0ubuntu3.13.18.5.2-0ubuntu3.2 |
None known |
evolutionUbuntu:18.04:LTS |
All versions, plus listed versions 3.26.1-13.26.2-13.26.2-1ubuntu13.26.3-13.26.5-1 Show 8 moreShow less3.26.5-1build13.27.90-13.28.0-13.28.0-43.28.1-13.28.1-23.28.5-0ubuntu0.18.04.13.28.5-0ubuntu0.18.04.2 |
None known |
evolutionUbuntu:20.04:LTS |
All versions, plus listed versions 3.34.1-23.34.1-2build13.34.1-33.34.1-43.35.91-1 Show 8 moreShow less3.35.92-13.36.0-13.36.1-13.36.1-23.36.2-0ubuntu13.36.3-0ubuntu13.36.4-0ubuntu13.36.5-0ubuntu1 |
None known |
evolutionUbuntu:22.04:LTS |
All versions, plus listed versions 3.40.4-13.42.0-23.42.1-13.42.2-13.42.3-1 Show 7 moreShow less3.43.3-13.44.0-13.44.0-1ubuntu13.44.1-0ubuntu13.44.4-0ubuntu13.44.4-0ubuntu23.44.4-0ubuntu2.1 |
None known |
evolutionUbuntu:24.04:LTS |
All versions, plus listed versions 3.50.0-13.50.1-13.50.2-13.50.3-13.52.0-1build13.52.0-1build23.52.3-0ubuntu13.52.3-0ubuntu1.1 |
None known |
evolutionUbuntu:26.10 |
All versions, plus listed versions 3.56.2-93.56.2-103.56.2-10build1 |
None known |
evolutionUbuntu:26.04:LTS |
All versions, plus listed versions 3.56.2-43.56.2-53.56.2-73.56.2-83.56.2-9 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | CVE List, NVD, OSV | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-88859 is a medium vulnerability (CVSS 6.3) in Red Hat Enterprise Linux 6, published September 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 44th percentile. Fixed in evolution 3.58.2-1.1.mga10.
References
Left out here: 2 versions. The JSON record has them.