CVE-2026-88859CWE-84

CVE-2026-88859

Medium · published September 10, 2026

CVSS v3.1
6.3
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00528 · 43.9th percentile
Weakness
CWE-84 · Improper Neutralization of Encoded URI Schemes in a Web Page
Published
2026-09-10T16:16Z
References (3)
https://access.redhat.com/security/cve/CVE-2026-88859 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2531401 · [email protected]https://gitlab.gnome.org/GNOME/evolution/-/work_items/3388 · [email protected]
EPSS history
Timeline
  • 12 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 10 SEP 11:24Z
    Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction
    cvelistv5