CVE-2026-26266 AliasVault affected by Cross-Site Scripting (XSS) via Email HTML Rendering
Attackers can execute arbitrary JavaScript in the victim's browser by sending crafted emails, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-26266?
CVE-2026-26266 is a critical cross-site scripting vulnerability in aliasvault, published on 3 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received emails on an alias, the HTML content is rendered in an iframe using srcdoc, which does not provide origin isolation. An attacker can send a crafted email containing malicious JavaScript to any AliasVault email alias. When the victim views the email in the web client, the script executes in the same origin as the application. No sanitization or sandboxing was applied to email HTML content before rendering. This vulnerability is fixed in 0.26.0.[
Weakness: CWE-79
Which versions are affected by CVE-2026-26266?
It affects 1 product.
Products include Aliasvault Aliasvault.
How do I fix CVE-2026-26266?
No fix has been published for CVE-2026-26266 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-26266 being exploited?
There is no known exploitation of CVE-2026-26266 in the wild and no public exploit code.
Other vulnerabilities in aliasvault
Sources
Also known as GHSA-f65p-p65r-g53q.