{"affected":[{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"evolution","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"evolution","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"evolution","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"evolution","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-88859","cwes":["CWE-84"],"description":"A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.","epss":{"date":"2026-11-05","percentile":0.44858,"score":0.00528},"exploits":[],"kev":null,"metrics":[{"score":6.3,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"}],"modifiedAt":1793927610252,"publishedAt":1789039494094,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-88859"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531401"},{"source":"CNA: redhat","tags":[],"url":"https://gitlab.gnome.org/GNOME/evolution/-/work_items/3388"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"To mitigate this issue, users can disable JavaScript execution for HTML mail in Evolution. This can be done through the Evolution preferences or by using `gsettings`. Disabling JavaScript may affect the rendering and functionality of some legitimate HTML emails.\n\nTo disable JavaScript via `gsettings`, execute the following command:\n`gsettings set org.gnome.evolution.mail enable-javascript false`\n\nTo revert this change, execute:\n`gsettings set org.gnome.evolution.mail enable-javascript true`\n\nNote that changes to `gsettings` take effect immediately, but Evolution may need to be restarted for the setting to be fully applied to already open mail views."}],"revision":"2a21e173f2aa0e4059bcb765f1150469373f05c7d0adfe267ca70924e94e84d1","sources":[{"modifiedAt":1793927610252,"name":"CNA: redhat","retrievedAt":1793931052687,"url":"https://www.cve.org/CVERecord?id=CVE-2026-88859"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793931090197,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88859"}],"ssvc":{"assessedAt":1789040225635,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction","updatedAt":1793931090197}