CVE-2026-26266 - Vulnerability Analysis

Overview

AliasVault Web Client <= 0.25.3 contains a stored XSS caused by unsanitized HTML email content rendered in an iframe using srcdoc without origin isolation, letting attackers execute scripts in the application origin when victims view crafted emails.

Severity & Score

Impact

Attackers can execute arbitrary scripts in the victim's browser, potentially stealing data or performing actions on behalf of the user.

Mitigation

Update to version 0.26.0 or later.

References

• https://github.com/aliasvault/aliasvault/commit/382e2e96fa502891638a48404f6d82dc972ab481
• https://github.com/aliasvault/aliasvault/releases/tag/0.26.0
• https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f65p-p65r-g53q

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner