CVE-2025-8029CWE-80

CVE-2025-8029

High · published July 23, 2025

CVSS v3.1
8.1
EPSS
0%
Percentile
27.4
In the wild
Unconfirmed
What it is

Thunderbird executed `javascript:` URLs when used in `object` and `embed` tags. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00350 · 27.4th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2025-07-23T01:15Z
Affected products (6)
ProductVersionsFixed in
mozilla/firefox< 128.13.0128.13.0
mozilla/firefox< 141.0141.0
mozilla/firefox≥ 140.0, < 140.1.0140.1.0
mozilla/thunderbird< 128.13.0128.13.0
mozilla/thunderbird< 141.0141.0
mozilla/thunderbird≥ 140.0, < 140.1.0140.1.0
References (8)
https://bugzilla.mozilla.org/show_bug.cgi?id=1928021 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-56/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-58/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-59/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-61/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-62/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-63/ · [email protected]https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 22 JUL 20:49Z
    javascript: URLs executed on object and embed tags
    cvelistv5