CVE-2026-93405: Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)
Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote sender can craft a supported attachment whose converted HTML executes script when a recipient opens quick preview. The preview renderer has no direct Node or Electron access, but injected script can reach the IPC surface exposed to the quick-preview renderer. This issue alone provides script execution in the preview renderer; separate path-traversal and renderer-controlled file-write vulnerabilities are required for the documented persistent code-execution chain. This issue is fixed in version 1.17.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mailspringto a version that resolves this vulnerability.Fixed in 1.17.0
Event History
Frequently Asked Questions
Who can exploit this issue, and what user action is required?
Any remote sender who can deliver a crafted Markdown, DOCX, or XLSX attachment to a recipient can target the issue. The recipient must open the attachment using quick preview for the converted content to execute script.
Which installations are affected?
Mailspring versions prior to 1.17.0 are affected. The issue is fixed in version 1.17.0.
Does this vulnerability by itself provide persistent code execution on the host?
No. By itself, it provides script execution in the quick-preview renderer, which does not have direct Node or Electron access. The documented persistent code-execution chain additionally requires separate path-traversal and renderer-controlled file-write vulnerabilities.
What should teams do if they cannot immediately upgrade?
Avoid opening untrusted Markdown, DOCX, and XLSX attachments through Mailspring's quick preview. Treat attachments in those formats from remote senders as potentially malicious until upgrading to 1.17.0.