This vulnerability is a stored mutation XSS in SmarterMail that allows remote attackers to inject executable JavaScript into calendar (iCal) messages. The attacker places a <style> tag inside MathML foreign content (<math><mtext><mglyph>), which the custom HTML sanitizer treats as inert CDATA. Browsers re‑parse the content as live markup, and when the victim opens the message in the webmail interface (/interface/message‑iframe) the embedded script executes immediately within the victim’s browser context, bypassing the interface’s permissive Content‑Security‑Policy and allowing unrestricted data exfiltration.

SmarterTools: SmarterMail – all builds prior to build 9777 are affected. The issue is addressed in build 9777 and later.

The CVSS score of 5.3 indicates moderate severity. An EPSS score is not available, so exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog. Attackers can deliver a crafted iCal file to a victim; when the victim opens the attachment in the webmail interface the malicious script runs, enabling client‑side code execution and theft of sensitive information without requiring local or privileged access.