Vulnerability Description
Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote sender can craft a supported attachment whose converted HTML executes script when a recipient opens quick preview. The preview renderer has no direct Node or Electron access, but injected script can reach the IPC surface exposed to the quick-preview renderer. This issue alone provides script execution in the preview renderer; separate path-traversal and renderer-controlled file-write vulnerabilities are required for the documented persistent code-execution chain. This issue is fixed in version 1.17.0.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/Foundry376/Mailspring/commit/5728388199666ec0a9a58f693c89c25b
- https://github.com/Foundry376/Mailspring/pull/2523
- https://github.com/Foundry376/Mailspring/releases/tag/1.17.0
- https://github.com/Foundry376/Mailspring/security/advisories/GHSA-px2g-jhg5-c6gh
FAQ
What is CVE-2026-93405?
CVE-2026-93405 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts...
How severe is CVE-2026-93405?
CVE-2026-93405 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-93405?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.