CVE-2026-93405

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...

CVE-2026-93405 Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...

CVE-2026-93405 Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...

CVE-2026-93405

The Mailspring email client is vulnerable to Stored XSS in the attachment quick preview feature in versions prior to 1.17.0 . The application fails to sanitize HTML generated from Markdown, DOCX, and XLSX attachments converted via Snarkdown, Mammoth, and SheetJS, inserting the result into the pre...

CVE-2026-93405 Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...

EUVD-2026-86337

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...

PT-2026-98230

Name of the Vulnerable Software and Affected Versions Mailspring versions prior to 1.17.0 Description The attachment quick preview feature converts Markdown, DOCX, and XLSX attachments using Snarkdown, Mammoth, and SheetJS, then inserts the resulting HTML into the preview document via innerHTML...

CVE-2026-93405: Improper Neutralization of Input During Web Page Generation

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...

Ivanti Releases Urgent Fix for Critical Sentry RCE Vulnerability

Ivanti has disclosed details of a critical remote code execution flaw impacting Standalone Sentry, urging customers to apply the fixes immediately to stay protected against potential cyber threats. Tracked as CVE-2023-41724, the vulnerability carries a CVSS score of 9.6. "An unauthenticated threa...