Remote Code Execution Vulnerability in Evolution Email Client by GNOME
CVE-2026-88859

5.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Vendor
CVE Published:
10 September 2026

What is CVE-2026-88859?

A vulnerability in the Evolution email client allows remote attackers to execute arbitrary JavaScript code. The flaw lies in the handling of specially crafted HTML emails that contain spoofed vCard controls. When users interact with these controls, the email client’s JavaScript handler erroneously sets an attacker-controlled URL to an iframe's source, enabling the execution of malicious scripts that bypass existing safeguards against script execution in email content. This threat underscores the importance of scrutinizing email interactions to protect against potential exploitation.

References

https://access.redhat.com/security/cve/CVE-2026-88859
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2531401
issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/evolution/-/work_items/3388

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Jurre van Bergen for reporting this issue.
.