anonhaven

CVE-2026-93405

MEDIUM CVSS 3.1: 6.1 EPSS 0.22%
Updated Sep 30, 2026
Mailspring
Parameter Value
CVSS 6.1 (MEDIUM)
Fixed In 1.17.0
Type CWE-79 (Cross-Site Scripting (XSS))
Vendor Mailspring
Public PoC No

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote sender can craft a supported attachment whose converted HTML executes script when a recipient opens quick preview.

The preview renderer has no direct Node or Electron access, but injected script can reach the IPC surface exposed to the quick-preview renderer. This issue alone provides script execution in the preview renderer; separate path-traversal and renderer-controlled file-write vulnerabilities are required for the documented persistent code-execution chain. This issue is fixed in version 1.17.0.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
Required
User action required

Impact Assessment

Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-79 Cross-Site Scripting (XSS)

Vulnerable Products

foundry376:mailspring

References 4

https://github.com/Foundry376/Mailspring/commit/5728388199666ec0a9a58f693c89c25…
security-advisories@github.com
https://github.com/Foundry376/Mailspring/pull/2523
security-advisories@github.com
https://github.com/Foundry376/Mailspring/releases/tag/1.17.0
security-advisories@github.com
https://github.com/Foundry376/Mailspring/security/advisories/GHSA-px2g-jhg5-c6gh
security-advisories@github.com
Share Post Share Share Share