CVE-2026-93405

Name of the Vulnerable Software and Affected Versions Mailspring versions prior to 1.17.0

Description The attachment quick preview feature converts Markdown, DOCX, and XLSX attachments using Snarkdown, Mammoth, and SheetJS, then inserts the resulting HTML into the preview document via innerHTML without sanitization. A remote sender can craft a supported attachment that executes scripts when the recipient opens the quick preview. While the preview renderer lacks direct Node or Electron access, injected scripts can reach the IPC (Inter-Process Communication) surface exposed to the quick-preview renderer, allowing script execution within that context.

Recommendations Update to version 1.17.0.