{"id":"CVE-2026-118179","state":"PUBLISHED","title":"Request forgery via news: links","description":"Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.","publishedAt":"2026-10-27T18:16:32.658Z","updatedAt":"2026-10-27T18:27:52.176Z","severity":null,"assigner":"mozilla","products":["Mozilla Thunderbird"],"affected":[{"vendor":"Mozilla","product":"Thunderbird","versions":[{"version":"153.6","status":"unaffected","lessThanOrEqual":"153.*","versionType":"rpm"},{"version":"159","status":"unaffected","lessThanOrEqual":"*","versionType":"rpm"}]}],"references":["https://bugzilla.mozilla.org/show_bug.cgi?id=2077789","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"weaknesses":[],"ingestedAt":"2026-10-29T20:10:52.580Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/118xxx/CVE-2026-118179.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-118179","state":"PUBLISHED","datePublished":"2026-10-27T18:16:32.658Z","dateUpdated":"2026-10-27T18:27:52.176Z","assignerShortName":"mozilla","assignerOrgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe","dateReserved":"2026-10-27T18:16:32.317Z"},"containers":{"cna":{"title":"Request forgery via news: links","descriptions":[{"lang":"en","value":"Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."}],"affected":[{"vendor":"Mozilla","product":"Thunderbird","versions":[{"version":"153.6","status":"unaffected","lessThanOrEqual":"153.*","versionType":"rpm"},{"version":"159","status":"unaffected","lessThanOrEqual":"*","versionType":"rpm"}]}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2077789"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-121/"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-122/"}],"providerMetadata":{"shortName":"mozilla","orgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe","dateUpdated":"2026-10-27T18:27:52.176Z"},"credits":[{"lang":"en","value":"Nguyen Tuan Hung"}]}}}}