CVE-2026-113867

The record

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

Affected packages

Related vulnerabilities

• CVE-2026-63346 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-116
• CVE-2026-63344 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-116
• CVE-2026-104368 The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege… CWE-116
• CVE-2026-118256 Vue I18n is the internationalization plugin for Vue.js. CWE-116
• CVE-2026-118257 Vue I18n is the internationalization plugin for Vue.js. CWE-116
• CVE-2026-110910 ### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array… CWE-116
• CVE-2026-116582 Seroval facilitates JavaScript value stringification, including complex structures beyond… CWE-116
• CVE-2026-55442 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-116