Executive brief
Thunderbird's mail.allowed_attachment_hostnames configuration setting was not properly escaped before being used in regular expressions, allowing attackers to bypass hostname restrictions and serve malicious remote attachments. This could enable credential theft, malware distribution, or phishing attacks by disguising malicious content as legitimate remote attachments from trusted sources.
Technical details
The vulnerability is a regex injection flaw in Thunderbird's attachment hostname filtering logic. The mail.allowed_attachment_hostnames configuration values were directly used in regular expression matching without proper escaping of special regex metacharacters. An attacker who controls or can influence this configuration value could craft a hostname containing regex metacharacters (e.g., ".", "*", "|") that would match unintended hostnames when evaluated as a regex pattern. This allows bypass of the hostname allowlist, permitting attachment downloads from attacker-controlled servers. The vulnerability affects Thunderbird versions prior to 155 and ESR 153.2. No user interaction is typically required beyond having the misconfigured or compromised setting.
Affected products
- Mozilla Thunderbird before 155, before ESR 153.2
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Thunderbird 155 and Thunderbird ESR 153.2