CVE-2026-93405

The Mailspring email client is vulnerable to Stored XSS in the attachment quick preview feature in versions prior to 1.17.0 . The application fails to sanitize HTML generated from Markdown, DOCX, and XLSX attachments converted via Snarkdown, Mammoth, and SheetJS, inserting the result into the pre...