Log in Start free

Vulnerability · Published Sep 10, 2026 · Assigned by redhat

CVE-2026-88859Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction

Medium 6.3

In plain English

A medium-severity security flaw in Red Hat Enterprise Linux 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.5%top 55.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12evolutionno fix listedDEBIAN-CVE-2026-88859
Debian:13evolutionno fix listedDEBIAN-CVE-2026-88859
Debian:14evolutionno fix listedDEBIAN-CVE-2026-88859
Ubuntu:22.04:LTSevolutionno fix listedUBUNTU-CVE-2026-88859
Ubuntu:24.04:LTSevolutionno fix listedUBUNTU-CVE-2026-88859
Ubuntu:26.04:LTSevolutionno fix listedUBUNTU-CVE-2026-88859
Ubuntu:26.10evolutionno fix listedUBUNTU-CVE-2026-88859

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-84 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References