A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22263-1 advisory.

    Changes in evolution:

    - CVE-2026-88859: JavaScript handler incorrectly assigns an       attacker-controlled JavaScript URL to an iframe's source when       processing a crafted HTML email containing a spoofed vCard       control, which can lead to arbitrary JavaScript execution (bsc#1280004)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-5debc0de2b advisory.

    Update to 3.62.0

    #### evolution-data-server

    Bug Fixes:

    * I#660 - GOA EWS: Do not require OABUrl in autodiscover
    * I#662 - EBackend: Document how OAuth2 sources should ask to be authenticated (Tobias Mueller)
    * I#665 - CalDAV: Ignore Bad Request (400) on overwrite
    * M!243 - ESourceRegistry: Name the credentials source in failed-lookup debug message (Tobias Mueller)

    Translations:

    * Alan Mortensen (da)
    * Aurimas ernius (lt)
    * Balzs r (hu)
    * Baurzhan Muftakhidinov (kk)
    * Emin Tufan etin (tr)
    * Juliano de Souza Camargo (pt_BR)
    * Kjartan Maraas (nb)


    #### evolution

    Bug Fixes:

    * I#3381 - Composer: De-duplicate inline images before send
    * I#3383 - junk-filters: Do not leak the child stdin pipe into concurrent spawns (Benjamin Herrenschmidt)
    * I#3386 - Default to not use read-only calendars for reminders and conflict search
    * I#3387 - EUIParser: Notify about accelerators moved by an action rename (Martin Monperrus (AI-assisted))
    * I#3388 - Mail: Validate clickable preview elements are generated by Evolution
    * M!235 - Mail: Remove deprecated SHA1 signature algorithm (Robin Haberkorn)

    Miscellaneous:

    * docs: Add API index for newly added symbols in 3.62 for e-util

    Translations:

    * Alan Mortensen (da)
    * Aurimas ernius (lt)
    * Balzs r (hu)
    * Baurzhan Muftakhidinov (kk)
    * burns (pt_BR)
    * Emin Tufan etin (tr)
    * Guillaume Bernard (fr)
    * Jiri Eischmann (cs)
    * Kjartan Maraas (nb)


    #### evolution-ews

    Bug Fixes:

    * M!18 - Add a per-folder coalescing gate for sync and refresh (Benjamin Herrenschmidt)
    * M!19 - camel: Do not save the folder summary in the subclass dispose (David Woodhouse)

    Translations:

    * Alan Mortensen (da)
    * Balzs r (hu)
    * Jiri Eischmann (cs)
    * Kjartan Maraas (nb)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-99a4ff5552 advisory.

    Add a patch to validate clickable preview elements in the Mail. Fixes CVE-2026-88859.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1ea9bbcb29 advisory.

    Add a patch to validate clickable preview elements in the Mail. Fixes CVE-2026-88859.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially     crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's     trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's     source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively     bypassing the security measures designed to prevent script execution in email content. (CVE-2026-88859)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
379532	openSUSE 16: evolution / evolution-devel / evolution-lang / etc (openSUSE-SU-2026:22263-1)	Nessus	SuSE Local Security Checks	Local	medium
349564	Fedora 45 : evolution / evolution-data-server / evolution-ews (2026-5debc0de2b)	Nessus	Fedora Local Security Checks	Local	medium
348257	Fedora 44 : evolution (2026-99a4ff5552)	Nessus	Fedora Local Security Checks	Local	medium
348249	Fedora 43 : evolution (2026-1ea9bbcb29)	Nessus	Fedora Local Security Checks	Local	medium
344594	Linux Distros Unpatched Vulnerability : CVE-2026-88859	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-88859

medium

Tenable Plugins

medium

medium

medium

medium

medium