Read the docs
TI-2026-70083 Aliases CVE-2026-104083GHSA-vvh8-jc22-6q2f

Stored mutation XSS in SmarterMail via MathML foreign content

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

SmarterMail before Build 9777 has a stored mutation cross-site scripting flaw (CWE-79). Its custom HTML sanitizer treats content inside a style element nested in MathML as inert text, while browsers parse it as live markup. A remote attacker can send a crafted calendar (iCal) message that runs script in the recipient's webmail session when the message is opened, enabling script execution and data exfiltration. An exploit link is listed in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a <style> element nested within MathML foreign content (<math><mtext><mglyph>), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an <img src=x onerror=...> payload that executes automatically in the recipient's webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface's permissive Content-Security-Policy.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00326 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Smartermail (Smartertools): Build 9777

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SmarterToolsSmartermailbefore Build 9777Build 9777Patch availableCNA
  • Smartermail VendorSmarterTools Affected before Build 9777 Fixed in Build 9777 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:*——SmarterTools
  • cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:* Versions — — ·SmarterTools

Remediation

Upgrade Smartertools SmarterMail to Build 9777, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Smartermail (Smartertools) Fixed in Build 9777

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Smartertools Smartermail Build 9777

    3 records Highest priority Priority HIGH 1 HIGH, 2 LOW

    Other records, highest priority first

    • TI-2026-70082 Code injection in SmarterMail Volume Mount allows code executionPriority HIGH 72
    • TI-2026-70084 Stale JWT role claim allows privilege escalation in SmarterMailPriority LOW 39
    Show all 3 records →

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-104083
  2. 2026-10-12 1 new reference · CNA
  3. 2026-10-12 Alias added: GHSA-vvh8-jc22-6q2f
  4. 2026-10-13 CISA SSVC decision points changed

References

Exploit 1

Patch 1

  • TI-2025-32755 Upload arbitrary files in SmarterTools SmarterMail KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-19690 SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API KEVCVSS 4.0CRITICAL 9.3
  • TI-2026-19133 SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API KEVCVSS 4.0CRITICAL 9.3
  • TI-2019-05110 SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. CVSS 3.0CRITICAL 9.8
  • TI-2026-70082 Code injection in SmarterMail Volume Mount allows code execution CVSS 4.0HIGH 8.6
  • TI-2020-19061 SmarterTools SmarterTrack 7922 -Information Disclosure CVSS 4.0MEDIUM 6.9
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences