DEBIAN-CVE-2026-88859

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-88859
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-88859.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-88859
Upstream
  • CVE-2026-88859
Published
2026-09-10T12:16:33Z
Modified
2026-09-11T06:00:21Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.

References

Affected packages

Debian:12 / evolution

Package

Name
evolution
Purl
pkg:deb/debian/evolution?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.46.4-2
3.46.4-2+deb12u1
3.47.2-1
3.47.3-1
3.48.0-1
3.48.1-1
3.48.2-1
3.48.3-1
3.48.4-1
3.49.2-1
3.49.2-2
3.49.2-3
3.49.3-1
3.50.0-1
3.50.1-1
3.50.2-1
3.50.3-1
3.51.2-1
3.52.0-1
3.52.1-1
3.52.1-2
3.52.1-3
3.52.1-4
3.52.2-1
3.52.2-2
3.52.3-1
3.53.2-1
3.53.3-1
3.54.0-1
3.54.1-1
3.54.2-1
3.54.3-1
3.54.3-2
3.55.1-1
3.55.1-2
3.55.2-1
3.55.3-1
3.56.0-1
3.56.1-1
3.56.2-1
3.56.2-2
3.56.2-3
3.56.2-4
3.56.2-5
3.56.2-7
3.56.2-8
3.56.2-9
3.56.2-10

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-88859.json"

Debian:13 / evolution

Package

Name
evolution
Purl
pkg:deb/debian/evolution?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.56.1-1
3.56.1-1+deb13u1
3.56.2-0+deb13u1
3.56.2-1
3.56.2-2
3.56.2-3
3.56.2-4
3.56.2-5
3.56.2-7
3.56.2-8
3.56.2-9
3.56.2-10

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-88859.json"

Debian:14 / evolution

Package

Name
evolution
Purl
pkg:deb/debian/evolution?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.56.1-1
3.56.2-1
3.56.2-2
3.56.2-3
3.56.2-4
3.56.2-5
3.56.2-7
3.56.2-8
3.56.2-9
3.56.2-10

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-88859.json"