A stored Cross‑Site Scripting vulnerability has been found in the AliasVault web client. The flaw resides in the manner by which received email messages that contain HTML are displayed. The application places the entire HTML body inside an iframe via the srcdoc attribute, and this rendering occurs without any sanitization or origin isolation. As a result, a malicious script contained in an email will run under the same origin as the AliasVault web client when the recipient opens the message. Because the code executes with the privileges of the application and can access user data stored in cookies or local storage, an attacker could steal credentials, inject malware, or otherwise manipulate the victim’s session. The weakness is classified as CWE‑79.

The affected product is AliasVault email aliasing and password manager, in all releases up through 0.25.3. The problem exists in the web client that handles email rendering. Users running any 0.25.3 or earlier version are susceptible. AliasVault is listed under the aliasvault vendor name in the CNA data. Version information that mitigates the issue starts at 0.26.0 as referenced by the release notes.

The CVSS score is 9.3, marking it as critical. The EPSS score is less than 1 %, indicating that real‑world exploitation is currently unlikely but possible. The vulnerability is not yet in the CISA KEV catalog. Attackers can exploit it by crafting an email with malicious JavaScript and sending it to any AliasVault alias. The victim must be logged into the web client to view the message for the exploit to succeed. Since the script runs with the same origin as AliasVault, it can bypass same‑origin policy restrictions and read session cookies or local storage, providing a wide attack surface.