{"id":"CVE-2026-88859","aliases":["DEBIAN-CVE-2026-88859","EUVD-2026-75397","GHSA-8j98-q77q-pmv2","MGASA-2026-0554","UBUNTU-CVE-2026-88859","openSUSE-SU-2026:22263-1"],"status":"published","title":"Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction","description":"A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00528,"percentile":0.45165,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-84"],"published":"2026-09-10T11:24:54Z","modified":"2026-11-10T20:30:03Z","fixes":[{"ecosystem":"Mageia:10","package":"evolution","fixed_in":["3.58.2-1.1.mga10"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"evolution","fixed_in":["3.56.2-bp160.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.46.4-2","3.46.4-2+deb12u1","3.47.2-1","3.47.3-1","3.48.0-1","3.48.1-1","3.48.2-1","3.48.3-1","3.48.4-1","3.49.2-1","3.49.2-2","3.49.2-3","3.49.3-1","3.50.0-1","3.50.1-1","3.50.2-1","3.50.3-1","3.51.2-1","3.52.0-1","3.52.1-1","3.52.1-2","3.52.1-3","3.52.1-4","3.52.2-1","3.52.2-2","3.52.3-1","3.53.2-1","3.53.3-1","3.54.0-1","3.54.1-1","3.54.2-1","3.54.3-1","3.54.3-2","3.55.1-1","3.55.1-2","3.55.2-1","3.55.3-1","3.56.0-1","3.56.1-1","3.56.2-1","3.56.2-10","3.56.2-2","3.56.2-3","3.56.2-4","3.56.2-5","3.56.2-7","3.56.2-8","3.56.2-9","3.62.0-1","3.62.1-1","3.62.1-2","3.62.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.56.1-1","3.56.1-1+deb13u1","3.56.2-0+deb13u1","3.56.2-1","3.56.2-10","3.56.2-2","3.56.2-3","3.56.2-4","3.56.2-5","3.56.2-7","3.56.2-8","3.56.2-9","3.62.0-1","3.62.1-1","3.62.1-2","3.62.1-3"]},{"source":"osv","ecosystem":"Debian:14","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.56.1-1","3.56.2-1","3.56.2-10","3.56.2-2","3.56.2-3","3.56.2-4","3.56.2-5","3.56.2-7","3.56.2-8","3.56.2-9","3.62.0-1","3.62.1-1","3.62.1-2","3.62.1-3"]},{"source":"osv","ecosystem":"Mageia:10","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.58.2-1.1.mga10"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16.5-1ubuntu3","3.18.1-1ubuntu2","3.18.2-0ubuntu1","3.18.2-0ubuntu2","3.18.3-0ubuntu1","3.18.3-1ubuntu1","3.18.4-0ubuntu1","3.18.5-1ubuntu1","3.18.5.1-1ubuntu1","3.18.5.2-0ubuntu1","3.18.5.2-0ubuntu3","3.18.5.2-0ubuntu3.1","3.18.5.2-0ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.1-1","3.26.2-1","3.26.2-1ubuntu1","3.26.3-1","3.26.5-1","3.26.5-1build1","3.27.90-1","3.28.0-1","3.28.0-4","3.28.1-1","3.28.1-2","3.28.5-0ubuntu0.18.04.1","3.28.5-0ubuntu0.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.34.1-2","3.34.1-2build1","3.34.1-3","3.34.1-4","3.35.91-1","3.35.92-1","3.36.0-1","3.36.1-1","3.36.1-2","3.36.2-0ubuntu1","3.36.3-0ubuntu1","3.36.4-0ubuntu1","3.36.5-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.40.4-1","3.42.0-2","3.42.1-1","3.42.2-1","3.42.3-1","3.43.3-1","3.44.0-1","3.44.0-1ubuntu1","3.44.1-0ubuntu1","3.44.4-0ubuntu1","3.44.4-0ubuntu2","3.44.4-0ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.50.0-1","3.50.1-1","3.50.2-1","3.50.3-1","3.52.0-1build1","3.52.0-1build2","3.52.3-0ubuntu1","3.52.3-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.56.2-9","3.56.2-10","3.56.2-10build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.56.2-4","3.56.2-5","3.56.2-7","3.56.2-8","3.56.2-9"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.56.2-bp160.4.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-88859","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531401","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://gitlab.gnome.org/GNOME/evolution/-/work_items/3388","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88859"},{"url":"https://github.com/advisories/GHSA-8j98-q77q-pmv2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-88859","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0554.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36347","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YH7NPIRTW6F46HY7WMJUK3K2UZFR6H77/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-88859","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88859","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1280004","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88859","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-88859","title":"Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction","description":"A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.","status":"published","published":"2026-09-10T11:24:54.094Z","modified":"2026-11-06T01:13:30.252Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-84"],"updated_at":"2026-11-06T02:55:55.947181Z"}],"euvd":[{"id":"EUVD-2026-75397","description":"A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.","status":"published","published":"2026-09-10T11:24:54Z","modified":"2026-11-06T01:13:30Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-06T02:02:53.341523Z"}],"ghsa":[{"id":"GHSA-8j98-q77q-pmv2","title":"A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a...","description":"A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.","status":"published","published":"2026-09-10T12:31:20Z","modified":"2026-09-10T12:31:26Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-84"],"updated_at":"2026-11-02T15:11:41.43854Z"}],"nvd":[{"id":"CVE-2026-88859","description":"A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.","status":"published","published":"2026-09-10T12:16:33.98Z","modified":"2026-11-06T02:17:55.073Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-84"],"updated_at":"2026-11-06T06:59:05.303911Z"}],"osv":[{"id":"DEBIAN-CVE-2026-88859","description":"A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.","status":"published","published":"2026-09-10T12:16:33.98Z","modified":"2026-11-06T10:03:21.712828726Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-06T10:38:30.18578Z"},{"id":"UBUNTU-CVE-2026-88859","description":"A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.","status":"published","published":"2026-09-10T12:16:00Z","modified":"2026-10-17T13:01:16.086768472Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"MGASA-2026-0554","title":"Updated evolution package fixes a security vulnerability","description":"Javascript execution via spoofed vcard control bypasses mail\nscript-markup restriction. (CVE-2026-88859)\n","status":"published","published":"2026-10-27T04:31:25Z","modified":"2026-10-27T04:45:03.097358574Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:22263-1","title":"Security update for evolution","description":"This update for evolution fixes the following issues:\n\nChanges in evolution:\n\n- CVE-2026-88859: JavaScript handler incorrectly assigns an\n  attacker-controlled JavaScript URL to an iframe's source when\n  processing a crafted HTML email containing a spoofed vCard\n  control, which can lead to arbitrary JavaScript execution (bsc#1280004)\n","status":"published","published":"2026-11-09T18:36:54Z","modified":"2026-11-10T20:30:03.947984755Z","updated_at":"2026-11-10T20:43:04.310349Z"}]}}