What is the CVSS score of CVE-2026-26266?

CVE-2026-26266 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Aliasvault are affected by CVE-2026-26266?

A critical stored XSS vulnerability in AliasVault Web Client (v0.25.3 and below) allows attackers to inject malicious code through the email rendering feature, potentially compromising user…. A patch is available.

How to fix or mitigate CVE-2026-26266?

Within 24 hours: Identify all instances of AliasVault Web Client in your environment and document versions in use. Within 7 days: Apply the available vendor patch to all AliasVault deployments and verify successful patching across all systems. Within 30 days: Conduct security audit of AliasVault usage patterns, review access logs for suspicious activity during the vulnerability window, and reset credentials for high-privilege accounts that may have been exposed.

Aliasvault CVE-2026-26266

CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-03-03 security-advisories@github.com

XSS Aliasvault

9.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

Patch released

Mar 05, 2026 - 21:22 nvd

Patch available

CVE Published

Mar 03, 2026 - 23:15 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received emails on an alias, the HTML content is rendered in an iframe using srcdoc, which does not provide origin isolation. An attacker can send a crafted email containing malicious JavaScript to any AliasVault email alias. When the victim views the email in the web client, the script executes in the same origin as the application. No sanitization or sandboxing was applied to email HTML content before rendering. This vulnerability is fixed in 0.26.0.[