SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a <style> element nested within MathML foreign content (<math><mtext><mglyph>), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an <img src=x onerror=...> payload that executes automatically in the recipient's webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface's permissive Content-Security-Policy.
Affected: unknown SmarterMail <9777 Pre-Auth
original blog: https://blog.evan.lat/posts/sm/
SUMMARY: multiple vulns and misconfigurations in smartermail, notably a mxss and session persistence issues, alongside several logic bugs can be chained to achieve remote code execution as nt authority\system; https://nvd.nist.gov/vuln/detail/CVE-2026-104082 https://nvd.nist.gov/vuln/detail/CVE-2026-104083 https://nvd.nist.gov/vuln/detail/CVE-2026-104084
a mutated xss exists in smartermail. by sending a specific text/calendar (icalendar) mimetype with the x-alt-desc header set to a mutated xss payload: <math><mtext><mglyph><style><img src=x onerror="{js}"></style>
the parser in the handrolled sanitizer of smartermail fails to properly sanitize this. the payload reforms after attempts at parsing it, allowing us to circumvent pre-auth with just one viewing of an email. notably, this can be done entirely without clicking as well (technically), since smartermail seems to open to latest email automatically
====================
a session logic vuln exists in smartermail. getting the refresh token of a domain admin before they are subsequently demoted does not actually invalidate any of the tokens privileges; meaning you can replay the token and continue retaining domain admin/sysadmin even after being demoted by simply posting the refresh token to /api/v1/auth/refresh-token and getting new accesstoken/refreshtoken pairs with the same roles
====================
a series of logic vulns exist in smartermail that can lead to rce a…
SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a <style> element nested within MathML foreign content (<math><mtext><mglyph>), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an <img src=x onerror=...> payload that executes automatically in the recipient's webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface's permissive Content-Security-Policy.