---
id: CVE-2026-93405
title: 'Mailspring is a fast, cross-platform, open-source email client'
summary: >-
  Mailspring is a fast, cross-platform, open-source email client. Prior to
  1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments
  with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the
  preview …
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: Foundry376
product: Mailspring
affected:
  - Mailspring < 1.17.0
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T18:19:07.120'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93405'
references:
  - url: >-
      https://github.com/Foundry376/Mailspring/commit/5728388199666ec0a9a58f693c89c25b948a9b6c
    label: security-advisories@github.com
  - url: 'https://github.com/Foundry376/Mailspring/pull/2523'
    label: security-advisories@github.com
  - url: 'https://github.com/Foundry376/Mailspring/releases/tag/1.17.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Foundry376/Mailspring/security/advisories/GHSA-px2g-jhg5-c6gh
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-24T18:49:36.712Z'
---

## Overview

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote sender can craft a supported attachment whose converted HTML executes script when a recipient opens quick preview. The preview renderer has no direct Node or Electron access, but injected script can reach the IPC surface exposed to the quick-preview renderer. This issue alone provides script execution in the preview renderer; separate path-traversal and renderer-controlled file-write vulnerabilities are required for the documented persistent code-execution chain. This issue is fixed in version 1.17.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.