Search

Find a vulnerability

Search criteria

    2 vulnerabilities by Foundry376

    CVE-2026-93405 (GCVE-0-2026-93405)

    Vulnerability from nvd – Published: 2026-09-24 18:00 – Updated: 2026-09-29 03:02
    VLAI
    Title
    Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)
    Summary
    Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote sender can craft a supported attachment whose converted HTML executes script when a recipient opens quick preview. The preview renderer has no direct Node or Electron access, but injected script can reach the IPC surface exposed to the quick-preview renderer. This issue alone provides script execution in the preview renderer; separate path-traversal and renderer-controlled file-write vulnerabilities are required for the documented persistent code-execution chain. This issue is fixed in version 1.17.0.
    Severity
    6.1 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-29 03:02 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Foundry376 Mailspring Affected: < 1.17.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93405",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T03:02:37.474456Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T03:02:53.880Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Mailspring",
          "vendor": "Foundry376",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.17.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote sender can craft a supported attachment whose converted HTML executes script when a recipient opens quick preview. The preview renderer has no direct Node or Electron access, but injected script can reach the IPC surface exposed to the quick-preview renderer. This issue alone provides script execution in the preview renderer; separate path-traversal and renderer-controlled file-write vulnerabilities are required for the documented persistent code-execution chain. This issue is fixed in version 1.17.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T18:00:32.245Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Foundry376/Mailspring/security/advisories/GHSA-px2g-jhg5-c6gh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Foundry376/Mailspring/security/advisories/GHSA-px2g-jhg5-c6gh"
        },
        {
          "name": "https://github.com/Foundry376/Mailspring/pull/2523",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Foundry376/Mailspring/pull/2523"
        },
        {
          "name": "https://github.com/Foundry376/Mailspring/commit/5728388199666ec0a9a58f693c89c25b948a9b6c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Foundry376/Mailspring/commit/5728388199666ec0a9a58f693c89c25b948a9b6c"
        },
        {
          "name": "https://github.com/Foundry376/Mailspring/releases/tag/1.17.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Foundry376/Mailspring/releases/tag/1.17.0"
        }
      ],
      "source": {
        "advisory": "GHSA-px2g-jhg5-c6gh",
        "discovery": "UNKNOWN"
      },
      "title": "Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-93405",
    "datePublished": "2026-09-24T18:00:32.245Z",
    "dateReserved": "2026-09-17T20:57:18.983Z",
    "dateUpdated": "2026-09-29T03:02:53.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-93405 (GCVE-0-2026-93405)

    Vulnerability from cvelistv5 – Published: 2026-09-24 18:00 – Updated: 2026-09-29 03:02
    VLAI
    Title
    Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)
    Summary
    Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote sender can craft a supported attachment whose converted HTML executes script when a recipient opens quick preview. The preview renderer has no direct Node or Electron access, but injected script can reach the IPC surface exposed to the quick-preview renderer. This issue alone provides script execution in the preview renderer; separate path-traversal and renderer-controlled file-write vulnerabilities are required for the documented persistent code-execution chain. This issue is fixed in version 1.17.0.
    Severity
    6.1 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-29 03:02 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Foundry376 Mailspring Affected: < 1.17.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93405",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T03:02:37.474456Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T03:02:53.880Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Mailspring",
          "vendor": "Foundry376",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.17.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote sender can craft a supported attachment whose converted HTML executes script when a recipient opens quick preview. The preview renderer has no direct Node or Electron access, but injected script can reach the IPC surface exposed to the quick-preview renderer. This issue alone provides script execution in the preview renderer; separate path-traversal and renderer-controlled file-write vulnerabilities are required for the documented persistent code-execution chain. This issue is fixed in version 1.17.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T18:00:32.245Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Foundry376/Mailspring/security/advisories/GHSA-px2g-jhg5-c6gh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Foundry376/Mailspring/security/advisories/GHSA-px2g-jhg5-c6gh"
        },
        {
          "name": "https://github.com/Foundry376/Mailspring/pull/2523",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Foundry376/Mailspring/pull/2523"
        },
        {
          "name": "https://github.com/Foundry376/Mailspring/commit/5728388199666ec0a9a58f693c89c25b948a9b6c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Foundry376/Mailspring/commit/5728388199666ec0a9a58f693c89c25b948a9b6c"
        },
        {
          "name": "https://github.com/Foundry376/Mailspring/releases/tag/1.17.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Foundry376/Mailspring/releases/tag/1.17.0"
        }
      ],
      "source": {
        "advisory": "GHSA-px2g-jhg5-c6gh",
        "discovery": "UNKNOWN"
      },
      "title": "Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-93405",
    "datePublished": "2026-09-24T18:00:32.245Z",
    "dateReserved": "2026-09-17T20:57:18.983Z",
    "dateUpdated": "2026-09-29T03:02:53.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}