CVE-2026-88859: Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Evolution users who view a specially crafted HTML email and click the spoofed vCard control are exposed. Exploitation is remote and does not require attacker authentication, but it requires user interaction.
Does merely receiving the malicious email trigger the vulnerability?
The provided information states that the victim must click the spoofed vCard control. It does not indicate that simply receiving or displaying the email is sufficient.
What can an attacker do after successful exploitation?
The attacker can cause arbitrary JavaScript to execute within Evolution's mail-viewing context. The stated impact includes low confidentiality and integrity impact, with no availability impact.