A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.
To mitigate this issue, users can disable JavaScript execution for HTML mail in Evolution. This can be done through the Evolution preferences or by using gsettings. Disabling JavaScript may affect the rendering and functionality of some legitimate HTML emails.
To disable JavaScript via gsettings, execute the following command:
gsettings set org.gnome.evolution.mail enable-javascript false
To revert this change, execute:
gsettings set org.gnome.evolution.mail enable-javascript true
Note that changes to gsettings take effect immediately, but Evolution may need to be restarted for the setting to be fully applied to already open mail views.