Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received emails on an alias, the HTML content is rendered in an iframe using srcdoc, which does not provide origin isolation. An attacker can send a crafted email containing malicious JavaScript to any AliasVault email alias. When the victim views the email in the web client, the script executes in the same origin as the application. No sanitization or sandboxing was applied to email HTML content before rendering. This vulnerability is fixed in 0.26.0.[
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-03 | 3 | Disclosure2Patch1 |
| 2026-03-04 | 3 | Disclosure2General1 |
CVE-2026-26266 Stored Cross-Site Scripting in AliasVault Web Client Email Rendering Feature https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26266
Post summary
A stored XSS vulnerability (CVE-2026-26266) was disclosed in AliasVault's web client email rendering feature, with no PoC, exploit, or patch details provided.
🚨 CVE-2026-26266 - CRITICAL AliasVault Password Manager 🤖 Stored XSS in email rendering. Malicious scripts execute when viewing crafted emails. ThreatScore: 93/100 🔗 http://threatmonitor.io/cve/CVE-2026-26266 #cybersecurity #infosec
Post summary
The post announces CVE-2026-26266 as a critical stored XSS vulnerability affecting AliasVault Password Manager, noting malicious script execution when viewing crafted emails, but does not provide a PoC, exploitation details, active exploitation mention, or patch information.
🔴 CVE-2026-26266 - Critical AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault ... https://www.thehackerwire.com/vulnerability/CVE-2026-26266/ https://t.co/iGnl4gF6TJ
Post summary
A stored XSS vulnerability (CVE‑2026‑26266) was disclosed in AliasVault’s email rendering feature, with no PoC, exploit, or patch details provided.
[CVE-2026-26266: CRITICAL] A cross-site scripting (XSS) vulnerability in AliasVault Web Client versions 0.25.3 and lower allowed attackers to execute malicious scripts via crafted emails. Update to version 0...#cve,CVE-2026-26266,#cybersecurity https://cvefind.com/CVE-2026-26266
Post summary
A critical XSS vulnerability in AliasVault Web Client allows malicious script execution via crafted emails; users are advised to update to the latest version.
🚨*CVE* CVE-2026-26266 AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering f… https://www.cve.org/CVERecord?id=CVE-2026-26266 ----- Traducción: CVE-2026-26266 Ali… http://infoflow.cloud`
Post summary
The post announces CVE-2026-26266, a stored XSS vulnerability in AliasVault’s email rendering, without providing details on exploitation or mitigation.
CVE-2026-26266 AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering f… https://www.cve.org/CVERecord?id=CVE-2026-26266
Post summary
A stored XSS vulnerability was identified in AliasVault’s email rendering component, but no PoC, exploit, or patch details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | aliasvault | aliasvault | - | - | - |