8 matches found
CVE-2026-93405
Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...
CVE-2026-93405 Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)
Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...
CVE-2026-93405 Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)
Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...
CVE-2026-93405 Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)
Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...
CVE-2026-93405
The Mailspring email client is vulnerable to Stored XSS in the attachment quick preview feature in versions prior to 1.17.0 . The application fails to sanitize HTML generated from Markdown, DOCX, and XLSX attachments converted via Snarkdown, Mammoth, and SheetJS, inserting the result into the pre...
PT-2026-98230
Name of the Vulnerable Software and Affected Versions Mailspring versions prior to 1.17.0 Description The attachment quick preview feature converts Markdown, DOCX, and XLSX attachments using Snarkdown, Mammoth, and SheetJS, then inserts the resulting HTML into the preview document via innerHTML...
MAL-2026-12753 Malicious code in devplatform-snarkdown (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 050140bdd00f1d32d6a6142067c28c92fe95ff1be979f4272c8966ba58c78b92 On require of the package, shim.js selects a platform-specific URL, downloads a binary from hardcoded Cloudflare Workers hosts...
Malicious code in devplatform-snarkdown (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 050140bdd00f1d32d6a6142067c28c92fe95ff1be979f4272c8966ba58c78b92 On require of the package, shim.js selects a platform-specific URL, downloads a binary from hardcoded Cloudflare Workers hosts...