CVE-2026-26266 - Vulnerability Analysis

Overview

AliasVault Web Client <= 0.25.3 contains a stored XSS caused by unsanitized HTML email content rendered in an iframe using srcdoc without origin isolation, letting attackers execute scripts in the application origin when victims view crafted emails.

Severity & Score

Impact

Attackers can execute arbitrary scripts in the victim's browser, potentially stealing data or performing actions on behalf of the user.

Mitigation

Update to version 0.26.0 or later.

References

• https://github.com/aliasvault/aliasvault/commit/382e2e96fa502891638a48404f6d82dc972ab481
• https://github.com/aliasvault/aliasvault/releases/tag/0.26.0
• https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f65p-p65r-g53q

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 4, 2026

🔴 CVE-2026-26266 - Critical (9.3) AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26266/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner