CVE-2026-88859
Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.
Fixes and workarounds
Workaround
To mitigate this issue, users can disable JavaScript execution for HTML mail in Evolution. This can be done through the Evolution preferences or by using `gsettings`. Disabling JavaScript may affect the rendering and functionality of some legitimate HTML emails. To disable JavaScript via `gsettings`, execute the following command: `gsettings set org.gnome.evolution.mail enable-javascript false` To revert this change, execute: `gsettings set org.gnome.evolution.mail enable-javascript true` Note that changes to `gsettings` take effect immediately, but Evolution may need to be restarted for the setting to be fully applied to already open mail views.
Source: CNA: redhatAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| Red Hat Enterprise Linux 6 Red Hat evolution
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat Enterprise Linux 7 Red Hat evolution
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 8 Red Hat evolution
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 9 Red Hat evolution
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 6.3 medium |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L | CNA: redhat |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://access.redhat.com/security/cve/CVE-2026-88859CNA: redhat · vdb-entry, x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2531401CNA: redhat · issue-tracking, x_refsource_REDHAT
- https://gitlab.gnome.org/GNOME/evolution/-/work_items/3388CNA: redhat
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.