CVE-2026-88859 PUBLISHED

Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction

Assigner: redhat
Reserved: 10.09.2026 Published: 10.09.2026 Updated: 10.09.2026

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS Score: 6.3

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected

Workarounds

To mitigate this issue, users can disable JavaScript execution for HTML mail in Evolution. This can be done through the Evolution preferences or by using gsettings. Disabling JavaScript may affect the rendering and functionality of some legitimate HTML emails.

To disable JavaScript via gsettings, execute the following command: gsettings set org.gnome.evolution.mail enable-javascript false

To revert this change, execute: gsettings set org.gnome.evolution.mail enable-javascript true

Note that changes to gsettings take effect immediately, but Evolution may need to be restarted for the setting to be fully applied to already open mail views.

Credits

  • Red Hat would like to thank Jurre van Bergen for reporting this issue.

References

Problem Types

  • Improper Neutralization of Encoded URI Schemes in a Web Page CWE