CVE-2026-104083SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content
Updated under an hour ago ()
Does this affect you?
It affects Smartertools Smartermail. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a <style> element nested within MathML foreign content (<math><mtext><mglyph>), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an <img src=x onerror=...> payload that executes automatically in the recipient's webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface's permissive Content-Security-Policy.
- CVSS
- 6.1 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness (CWE)
- CWE-79
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 13, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Smartertools Smartermail smartertools:smartermail (from the name) | before Build 9777 | CNA record |
References
- https://www.smartertools.com/smartermail/release-notes/current#/9526:~:text=Build%209777%20(Oct%208%2C%202026)release-notes, patch
- https://blog.evan.lat/posts/sm/technical-description, exploit
- https://www.vulncheck.com/advisories/smartermail-build-9777-stored-mutation-xss-via-mathml-foreign-contentthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.