CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users can disable JavaScript execution for HTML mail in Evolution. This can be done through the Evolution preferences or by using gsettings. Disabling JavaScript may affect the rendering and functionality of some legitimate HTML emails.

To disable JavaScript via gsettings, execute the following command: gsettings set org.gnome.evolution.mail enable-javascript false

To revert this change, execute: gsettings set org.gnome.evolution.mail enable-javascript true

Note that changes to gsettings take effect immediately, but Evolution may need to be restarted for the setting to be fully applied to already open mail views.