Mailspring EUVD-2026-86337

Exploitation requires the victim to use Mailspring's attachment quick-preview feature and to open a crafted Markdown, DOCX, or XLSX attachment sent by the attacker - the payload rides in content that Snarkdown/Mammoth/SheetJS convert to HTML that is then written via innerHTML without sanitization. No authentication or special server configuration is needed (any remote sender can deliver the attachment), but the attack is LIMITED by mandatory user interaction (the recipient must actually open quick preview) and is confined to a preview renderer with no direct Node/Electron access. Persistent, host-level code execution is NOT achievable from this bug alone: the vendor states it must be chained with separate path-traversal and renderer-controlled file-write vulnerabilities. Affected versions are all releases prior to 1.17.0.

This is a genuine but bounded client-side risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1 Medium) accurately captures it: network-delivered (a malicious email attachment), low complexity, no attacker authentication needed, but it requires user interaction - the recipient must open the attachment's quick preview. The scope change (S:C) is well-justified because injected script escapes the sandboxed preview document to reach the IPC surface exposed to the quick-preview renderer, and low C/I with no availability impact reflect that this issue ALONE only yields script execution in a renderer with no direct Node/Electron access. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation is: no public exploit identified at time of analysis. The most important nuance the description supplies is that standalone this is 'just' preview-renderer XSS; the vendor explicitly notes that persistent code execution requires chaining two SEPARATE bugs (path traversal and renderer-controlled file write) not covered by this CVE. Treat this as a real medium-priority patching item for Mailspring users rather than a critical drop-everything issue, but note the elevated blast radius because Mailspring runs with legacy-insecure Electron settings (nodeIntegration:true, contextIsolation:false, enableRemoteModule:true per the PR's own upgrade-assessment doc), which makes reachable IPC more dangerous than a typical browser XSS.

A remote attacker emails the victim a crafted Markdown, DOCX, or XLSX attachment whose content, once converted to HTML by Snarkdown/Mammoth/SheetJS, contains a malicious script payload. When the victim opens the attachment's quick preview in Mailspring, the unsanitized HTML is written via innerHTML and the script executes in the preview renderer, from which it can invoke the IPC surface exposed to that renderer. No public POC was provided, and the attack needs user interaction (opening quick preview) but no authentication.