SmarterMail EUVD-2026-95888

Exploitation requires the attacker to deliver a crafted calendar (iCal) message whose body embeds an <img src=x onerror=...> payload inside a <style> element nested within MathML foreign content (<math><mtext><mglyph>); the payload only fires when the recipient opens that message in the SmarterMail webmail interface (/interface/message-iframe), so the victim must have an active authenticated webmail session and must view the message (UI:P / passive interaction). The affected scope is SmarterMail before build 9777. The core enabler is a sanitizer parsing differential (MathML-nested <style> treated as inert CDATA but reparsed by browsers as live markup) combined with a permissive Content-Security-Policy that does not block script execution or data exfiltration. Limiting factors: requires the victim to open the message, impact is confined to the victim's browser/session rather than the mail server host, and the fix exists in build 9777.

This is a medium-severity stored mutation XSS (CWE-79) in SmarterMail, vendor-scored CVSS 4.0 5.3. The 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) indicates remote, low-complexity, unauthenticated delivery requiring passive victim interaction (opening a message), with impact falling on the subsequent system - the victim's browser session (SC:L/SI:L, VC/VI/VA:N on the mail server itself). No EPSS score, SSVC decision, KEV listing, or POC indicator is present in the input: there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic risk driver is the delivery vector: because the payload rides inside a crafted iCal calendar message and auto-executes via <img onerror> when the recipient merely opens it at /interface/message-iframe, exploitation needs no victim click beyond viewing the message - stronger than typical stored XSS. The flaw is amplified by a permissive Content-Security-Policy that fails to constrain exfiltration, and by a sanitizer parsing-differential (treating a <style> element nested in MathML foreign content as inert CDATA while browsers reparse it as live markup) that defeats the existing defense. Net: a credible, patch-now issue for exposed SmarterMail webmail despite the moderate numeric score, but not a mass-exploitation emergency absent any exploitation-probability signal.

A remote attacker, without authentication, emails a crafted iCal calendar message to a SmarterMail user; the message body hides an <img src=x onerror=...> payload inside a <style> element nested in MathML foreign content (<math><mtext><mglyph>). When the victim opens the message in the webmail interface, the browser reparses the sanitizer-approved markup as live HTML and the onerror handler executes JavaScript in the authenticated session, exfiltrating session data under the interface's permissive CSP. No public exploit code is identified at time of analysis, though VulnCheck has published a technical advisory.