CVE-2026-26266: AliasVault affected by Cross-Site Scripting (XSS) via Email HTML Rendering
AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received emails on an alias, the HTML content is rendered in an iframe using srcdoc, which does not provide origin isolation. An attacker can send a crafted email containing malicious JavaScript to any AliasVault email alias. When the victim views the email in the web client, the script executes in the same origin as the application. No sanitization or sandboxing was applied to email HTML content before rendering. This vulnerability is fixed in 0.26.0.[
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26266?
CVE-2026-26266 is classified as a medium severity vulnerability due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2026-26266?
To mitigate CVE-2026-26266, upgrade to AliasVault Web Client version 0.26.0 or later where the vulnerability has been addressed.
What versions of AliasVault are affected by CVE-2026-26266?
CVE-2026-26266 affects AliasVault Web Client versions 0.25.3 and lower.
What types of attacks can be executed due to CVE-2026-26266?
Due to CVE-2026-26266, attackers can execute stored XSS attacks that may lead to unauthorized access or data manipulation.
Is user interaction required to exploit CVE-2026-26266?
Yes, successful exploitation of CVE-2026-26266 requires user interaction to execute the malicious script.