I would like to know why is it considered to be dangerous to open an email from an unknown source? 

I am using Gmail and I thought it's only unsafe to download an attachment and run it.

The first thing that came into my mind was what if the email text contains XSS JavaScript code but I am sure that every email provider has protected their site from getting XSS-ed.

What is going on behind the scenes when you get infected just by clicking on email and reading its content, for example on Gmail?

There is a small risk of an unknown bug — or a known but unpatched one — in your mail client allowing an attack by just viewing a message.

I think, though, that this very broad advice is also given as a defense against some types of phishing scams. Social engineering attacks are common and can lead to serious trouble. Making sure people are at least suspicious is a first line of defense. It is like telling an elderly grandparent to never give their credit card info over the phone — okay, sure, there are plenty of circumstances where doing that is relatively safe, but when they keep getting scammed over and over, it's easier to just say: don't do it.

Likewise, not opening mail keeps you from reading about the plight of an orphan in a war-torn region who has unexpectedly found a cache of Nazi gold and just needs $500 to smuggle it out and they'll share half with you, and your heart just goes out, and also that money wouldn't hurt.... Or, while you know the rule about attachments, this one says that it's pictures of the cutest kittens ever, and how can that be harmful — I'll just click it and okay now there are these boxes saying do I want to allow it, which is annoying because of course I do because I want to see the kittens....
