CVE-2026-26266
Published: 03 March 2026
Summary
CVE-2026-26266 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Aliasvault Aliasvault. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-26266 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, in the email rendering feature of the AliasVault Web Client. AliasVault is a privacy-first password manager with built-in email aliasing. The flaw affects versions 0.25.3 and lower, where HTML content from received emails on an alias is rendered inside an iframe using srcdoc without origin isolation. No sanitization or sandboxing is applied to the email HTML before rendering.
An unauthenticated attacker (PR:N) with network access (AV:N) can exploit this by sending a crafted email containing malicious JavaScript to any AliasVault email alias. When a victim (UI:R) views the email in the web client, the script executes in the same origin as the application, potentially leading to high confidentiality (C:H) and integrity (I:H) impacts with no availability impact (A:N). The vulnerability carries a CVSS v3.1 base score of 9.3 and a scope of changed (S:C).
The issue is addressed in AliasVault Web Client version 0.26.0. Official mitigation details are available in the GitHub security advisory (GHSA-f65p-p65r-g53q), the release notes for tag 0.26.0, and the fixing commit 382e2e96fa502891638a48404f6d82dc972ab481. Security practitioners should upgrade to 0.26.0 or later and review these resources for patch implementation.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9332
Vulnerability details
AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received emails on an alias, the HTML…
more
content is rendered in an iframe using srcdoc, which does not provide origin isolation. An attacker can send a crafted email containing malicious JavaScript to any AliasVault email alias. When the victim views the email in the web client, the script executes in the same origin as the application. No sanitization or sandboxing was applied to email HTML content before rendering. This vulnerability is fixed in 0.26.0.[
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public web client directly enables arbitrary JavaScript execution (T1059.007) via crafted email payload, browser session hijacking (T1185), web session cookie theft (T1539), and exploitation of the public-facing app (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates stored XSS by requiring validation and sanitization of untrusted email HTML input before processing or storage in the AliasVault Web Client.
Prevents XSS execution by filtering malicious JavaScript from email HTML output when rendered in the web client's iframe.
Provides malicious code protection mechanisms to block or detect execution of harmful JavaScript payloads from crafted emails during rendering.