Technical impact
The vulnerability allows a malicious sender to craft an attachment in Markdown, DOCX, or XLSX format that is converted to HTML by Mailspring’s preview engine. The conversion libraries (Snarkdown, Mammoth, and SheetJS) produce HTML that is then inserted into the preview using innerHTML without any sanitization, enabling arbitrary script execution when a recipient opens the quick preview. This injected script runs within the preview renderer, which does not have direct Node or Electron access, but can communicate with the IPC surface exposed to the renderer. While the stored XSS alone does not grant persistent code execution, the ability to run code in the preview renderer is sufficient for a threat actor to leverage additional vulnerabilities such as path‑traversal or file‑write for persistence.
Affected Systems
Foundry376’s Mailspring email client, versions prior to 1.17.0, is affected. The issue is resolved starting with release 1.17.0 and later. Only those installations that have not upgraded remain vulnerable.
Risk and Exploitability
The CVSS score of 6.1 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation data. The attack vector is remote: a compromised sender can embed the malicious attachment in an email; the recipient must open the quick preview to trigger script execution. Thus, the risk is realistic for exposed user bases that routinely open attachments.
