CVE-2026-26266

{"id": "CVE-2026-26266", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2026-03-03T23:15:54.877", "references": [{"url": "https://github.com/aliasvault/aliasvault/commit/382e2e96fa502891638a48404f6d82dc972ab481", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/aliasvault/aliasvault/releases/tag/0.26.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f65p-p65r-g53q", "tags": ["Patch", "Vendor Advisory", "Mitigation"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received emails on an alias, the HTML content is rendered in an iframe using srcdoc, which does not provide origin isolation. An attacker can send a crafted email containing malicious JavaScript to any AliasVault email alias. When the victim views the email in the web client, the script executes in the same origin as the application. No sanitization or sandboxing was applied to email HTML content before rendering. This vulnerability is fixed in 0.26.0.["}, {"lang": "es", "value": "AliasVault es un gestor de contrase\u00f1as centrado en la privacidad con alias de correo electr\u00f3nico incorporados. Se identific\u00f3 una vulnerabilidad de cross-site scripting (XSS) almacenado en la funci\u00f3n de renderizado de correo electr\u00f3nico de las versiones 0.25.3 y anteriores del cliente web de AliasVault. Al ver correos electr\u00f3nicos recibidos en un alias, el contenido HTML se renderiza en un iframe usando srcdoc, lo que no proporciona aislamiento de origen. Un atacante puede enviar un correo electr\u00f3nico manipulado que contiene JavaScript malicioso a cualquier alias de correo electr\u00f3nico de AliasVault. Cuando la v\u00edctima ve el correo electr\u00f3nico en el cliente web, el script se ejecuta en el mismo origen que la aplicaci\u00f3n. No se aplic\u00f3 sanitizaci\u00f3n ni sandboxing al contenido HTML del correo electr\u00f3nico antes de la renderizaci\u00f3n. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 0.26.0."}], "lastModified": "2026-03-05T21:22:01.810", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:aliasvault:aliasvault:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "172C7352-14EF-4D15-B467-429505682C3F", "versionEndExcluding": "0.26.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}