Thunderbird failed to escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests are echoed back in automatic replies, a remote XMPP user can craft a request that causes Thunderbird to inject arbitrary stanzas into the user’s connection. The server then processes those injected stanzas as if they were sent by the user, enabling the attacker to send messages or alter contact and subscription settings without any user interaction. The flaw is an example of improper input validation (CWE‑91).

Mozilla Thunderbird’s chat feature for XMPP accounts is affected. The issue exists in versions prior to Thunderbird 158.0.1 and was fixed in that release.

The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 9.1 reflects high severity, and the ability to inject arbitrary XMPP stanzas allows an attacker to send messages or alter contact and subscription settings on behalf of the user. The attack vector is a remote XMPP user who sends a specially crafted request; no local privilege or insider access is required. With the current lack of publicly known exploits, the likelihood remains low, but the potential impact is high.