Vulnerability · Published Oct 9, 2026 · Assigned by VulnCheck

CVE-2026-104083SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content

Medium 6.1

In plain English

A medium-severity cross-site scripting in Smartermail from Smartertools. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 74.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a <style> element nested within MathML foreign content (<math><mtext><mglyph>), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an <img src=x onerror=...> payload that executes automatically in the recipient's webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface's permissive Content-Security-Policy.

Affected products (as reported)

Vendor	Product	Versions
Smartertools	Smartermail	0 – before Build 9777

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Release Notes release-notes, patch
Researcher Blog technical-description, exploit
VulnCheck Advisory: SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content third-party-advisory