The mail.allowed_attachment_hostnames advanced configuration setting is concatenated into a regular expression without proper escaping. For certain hostname patterns, this flaw causes additional unintended hostnames to match the expression, which results in Thunderbird fetching and displaying attachments from hosts that were not authorized. While the vulnerability does not enable arbitrary code execution, it allows the client to load potentially malicious attachments from unapproved remote servers. The weakness is categorized as CWE-20 and CWE-107.

Mozilla Thunderbird versions older than 153.2 are affected, as they contain the unescaped regular‑expression logic. The vulnerability was addressed in Thunderbird 153.2 and in subsequent releases such as 155, and any installation still using the mail.allowed_attachment_hostnames setting is potentially vulnerable if it has not been upgraded to a patched version.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploitation to date. However, the ability to bypass host filtering and fetch arbitrary attachments could enable delivery of malware or unauthorized data. The attack likely requires access to the client’s configuration or the ability to supply a crafted attachment that matches the malformed pattern. Prompt remediation is recommended even without confirmed public exploits.