CVE-2026-93405
Received Received - Intake

Mailspring Markdown Preview Script Injection Vulnerability

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote sender can craft a supported attachment whose converted HTML executes script when a recipient opens quick preview. The preview renderer has no direct Node or Electron access, but injected script can reach the IPC surface exposed to the quick-preview renderer. This issue alone provides script execution in the preview renderer; separate path-traversal and renderer-controlled file-write vulnerabilities are required for the documented persistent code-execution chain. This issue is fixed in version 1.17.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93405
EUVD
EUVD-2026-86337

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mailspring mailspring 1.17.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Mailspring versions before 1.17.0 have a vulnerability where attachment quick preview converts Markdown, DOCX, and XLSX files to HTML without sanitization. This allows a remote attacker to inject malicious scripts into the preview HTML via a crafted attachment. When a user opens the quick preview, the script executes in the preview renderer context.

Detection Guidance

Detecting this vulnerability requires checking if your Mailspring version is prior to 1.17.0. On Linux or macOS, run: mailspring --version. On Windows, check the installed version via the application's about section or control panel. If the version is below 1.17.0, the system is vulnerable.

Impact Analysis

If you use Mailspring before version 1.17.0, opening a malicious attachment in quick preview could allow an attacker to execute scripts in your email client. While the preview renderer lacks direct Node or Electron access, the injected script could interact with exposed IPC surfaces, potentially leading to further compromise if combined with other vulnerabilities.

Mitigation Strategies

Immediately update Mailspring to version 1.17.0 or later. Disable the quick preview feature for attachments if an update is not immediately possible. Avoid opening email attachments from untrusted sources until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93405. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart