AliasVault affected by Cross-Site Scripting (XSS) via Email HTML Rendering

The impact of this XSS vulnerability is significant. An attacker can craft a malicious email containing JavaScript code and send it to any AliasVault email alias. When a victim views this email in the AliasVault Web Client, the JavaScript executes in the same origin as the application. This allows the attacker to potentially steal session cookies, redirect the user to a phishing site, modify the content of the page, or perform other actions as if they were the legitimate user. The lack of origin isolation within the iframe rendering process exacerbates the risk, allowing for complete control over the user's session. This vulnerability could lead to widespread account compromise and data breaches.

Users of AliasVault Web Client, particularly those who rely on email aliasing for privacy, are at risk. Shared hosting environments where multiple users share the same AliasVault instance are especially vulnerable, as a compromised alias could potentially impact other users on the same server. Users who frequently open emails from unknown or untrusted senders are also at higher risk.

• javascript: Inspect AliasVault Web Client's JavaScript code for unsanitized HTML rendering within the email viewing functionality. Look for patterns involving srcdoc attributes in iframes. • generic web: Monitor AliasVault Web Client logs for unusual JavaScript execution patterns or requests to external domains originating from the email rendering feature. Use curl/wget to check for endpoint exposure related to email rendering. • generic web: Examine access and error logs for suspicious HTTP requests containing JavaScript payloads targeting the email rendering feature. Search for patterns like <script> tags or eval() functions within email content.

1. 2026-03-03Disclosure

   disclosure

1. आरक्षित2026-02-12
2. प्रकाशित2026-03-03
3. संशोधित2026-03-04
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-26266 is to immediately upgrade AliasVault Web Client to version 0.26.0 or later. Until the upgrade is possible, consider implementing strict email filtering rules to block emails from untrusted senders or containing suspicious HTML content. While not a complete solution, a Web Application Firewall (WAF) configured to detect and block XSS payloads targeting the email rendering feature can provide an additional layer of defense. Regularly review AliasVault's security advisories for further guidance and updates.