CVE-2026-93405 Details
Description
Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote sender can craft a supported attachment whose converted HTML executes script when a recipient opens quick preview. The preview renderer has no direct Node or Electron access, but injected script can reach the IPC surface exposed to the quick-preview renderer. This issue alone provides script execution in the preview renderer; separate path-traversal and renderer-controlled file-write vulnerabilities are required for the documented persistent code-execution chain. This issue is fixed in version 1.17.0.
A stored cross-site scripting vulnerability has been identified in Mailspring, an open-source email client, in versions prior to 1.17.0. The issue arises in the attachment quick preview feature, which converts Markdown, DOCX, and XLSX files into HTML using Snarkdown, Mammoth, and SheetJS, respectively. This conversion is then inserted into the preview document via innerHTML without proper sanitization. As a result, a remote sender can create a malicious attachment that executes scripts when the recipient opens the preview. Although the preview renderer lacks direct access to Node or Electron, injected scripts can interact with the IPC surface exposed to the quick-preview renderer, leading to potential exploitation.
Users can upgrade to Mailspring version 1.17.0 or later, where this vulnerability has been fixed. Instructions for updating can be found on the Mailspring GitHub page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Foundry376/Mailspring/commit/5728388199666ec0a9a58f693c89c25b948a9b6c | [email protected] | Source CodeVendor |
| https://github.com/Foundry376/Mailspring/pull/2523 | [email protected] | Issue TrackingVendor |
| https://github.com/Foundry376/Mailspring/releases/tag/1.17.0 | [email protected] | Release NotesVendor |
| https://github.com/Foundry376/Mailspring/security/advisories/GHSA-px2g-jhg5-c6gh | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mailspring | < 1.17.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 29, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | New CVE Received | [email protected] |