Mailspring
Monthly
Cross-site scripting in Mailspring's attachment quick-preview (all versions prior to 1.17.0) allows a remote, unauthenticated sender to execute script in the recipient's preview renderer by delivering a crafted Markdown, DOCX, or XLSX attachment that the victim opens in quick preview. Exploitation requires the recipient to actively open the preview (UI:R), and the injected script runs in a renderer that has no direct Node or Electron access, so it can reach the IPC surface exposed to the quick-preview renderer but cannot by itself achieve host-level code execution - Mailspring's advisory notes that persistent code execution requires chaining this bug with separate path-traversal and renderer-controlled file-write issues. The flaw is rated CVSS 6.1 and is fixed in Mailspring 1.17.0; no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site scripting in Mailspring's attachment quick-preview (all versions prior to 1.17.0) allows a remote, unauthenticated sender to execute script in the recipient's preview renderer by delivering a crafted Markdown, DOCX, or XLSX attachment that the victim opens in quick preview. Exploitation requires the recipient to actively open the preview (UI:R), and the injected script runs in a renderer that has no direct Node or Electron access, so it can reach the IPC surface exposed to the quick-preview renderer but cannot by itself achieve host-level code execution - Mailspring's advisory notes that persistent code execution requires chaining this bug with separate path-traversal and renderer-controlled file-write issues. The flaw is rated CVSS 6.1 and is fixed in Mailspring 1.17.0; no public exploit code or confirmed active exploitation was identified at time of analysis.