{"schema":"threatline.record/2","record":{"id":"CVE-2026-118179","aliases":[],"summary":"Request forgery via news: links","details":"Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.","categories":["Unclassified"],"product":"Thunderbird","vendor":"Mozilla","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118179","source_modified_at":"2026-10-27T18:27:52.176Z","fetched_at":"2026-10-27T21:14:11.489891Z","product":"Thunderbird","vendor":"Mozilla","versions":[{"status":"unaffected","version":"153.6","lessThanOrEqual":"153.*","versionType":"rpm"},{"status":"unaffected","version":"159","lessThanOrEqual":"*","versionType":"rpm"}],"defaultStatus":null}],"fixed_versions":[],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T18:16:32.658Z","modified_at":"2026-10-27T18:27:52.176Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-118179","fetched_at":"2026-10-27T21:14:11.489891Z","source_modified_at":"2026-10-27T18:27:52.176Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2077789"},{"source":"CVE List","url":"https://www.mozilla.org/security/advisories/mfsa2026-121/"},{"source":"CVE List","url":"https://www.mozilla.org/security/advisories/mfsa2026-122/"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T18:27:52.176Z","content_hash":"605663a8e54ba665ac3d4d5412c3ad99b1e11bf94593e407169a8667b8a34ced"}}