Vulnerability · Published Sep 24, 2026 · Assigned by GitHub_M
CVE-2026-93405Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)
Medium 6.1
In plain English
A medium-severity cross-site scripting in Mailspring from Foundry376. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Official description
Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote sender can craft a supported attachment whose converted HTML executes script when a recipient opens quick preview. The preview renderer has no direct Node or Electron access, but injected script can reach the IPC surface exposed to the quick-preview renderer. This issue alone provides script execution in the preview renderer; separate path-traversal and renderer-controlled file-write vulnerabilities are required for the documented persistent code-execution chain. This issue is fixed in version 1.17.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Foundry376 | Mailspring | < 1.17.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://github.com/Foundry376/Mailspring/security/advisories/GHSA-px2g-jhg5-c6gh x_refsource_CONFIRM
- https://github.com/Foundry376/Mailspring/pull/2523 x_refsource_MISC
- https://github.com/Foundry376/Mailspring/commit/5728388199666ec0a9a58f693c89c25b948a9b6c x_refsource_MISC
- https://github.com/Foundry376/Mailspring/releases/tag/1.17.0 x_refsource_MISC