CVE-2026-84642 in Thunderbird
Summary
by MITRE • 09/01/2026
The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 155 and Thunderbird 153.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The identified security flaw resides within the configuration handling of Mozilla Thunderbird's advanced mail settings, specifically concerning the mail.allowed_attachment_hostnames parameter. This setting is designed to restrict which remote hosts are permitted for loading external content such as images or attachments, serving as a critical defense against tracking and potential cross-site scripting vectors by limiting the scope of trusted domains. The vulnerability arises from a failure in input sanitization during the processing of this configuration value. When administrators define allowed hostnames within this setting, these values are directly incorporated into a regular expression pattern without proper escaping or validation of special regex metacharacters. This oversight creates a logic error where specific character sequences intended to represent literal hostname components can be interpreted as regex operators by the underlying parsing engine.
From a technical perspective, the core issue is an injection-like flaw within the configuration parser rather than traditional code execution. By failing to escape characters that hold special meaning in regular expressions, such as dots, asterisks, or parentheses depending on the specific implementation context, the system allows for pattern manipulation. For instance, if a hostname contains characters that act as wildcards or quantifiers in regex syntax, an attacker who can influence or predict these configuration values might craft inputs that broaden the matching criteria beyond the intended scope. This could result in unintended hostnames being matched against the allowed list, effectively bypassing the security restriction imposed by the administrator. The vulnerability exploits the assumption that input strings are treated as literal text rather than executable pattern definitions, a common pitfall when dynamic content is interpolated into regex patterns without rigorous escaping procedures like those provided by standard library functions for safe string interpolation.
The operational impact of this vulnerability centers on the potential erosion of privacy and security controls established by system administrators. If an attacker can manipulate or predict configuration inputs that feed into this setting, they may enable Thunderbird to fetch remote content from unauthorized domains. This undermines the principle of least privilege applied to network resources within the email client. Users relying on these restrictions for data loss prevention or anti-tracking measures would find their protections weakened. While the immediate risk might not involve direct code execution on the user's machine, it facilitates potential information disclosure through tracking pixels and could serve as a stepping stone in more complex attack chains where loading malicious content from untrusted sources is required to trigger further vulnerabilities within the rendering engine.
This flaw aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command or Regular Expression, specifically falling under categories related to injection flaws and improper input validation. In terms of adversary tactics, it relates to ATT&CK techniques involving resource hijacking or defense evasion through configuration manipulation, although the primary vector here is a software defect rather than active exploitation by an attacker with system access. The vulnerability highlights the importance of secure coding practices when handling user-defined configurations that influence security boundaries. Developers must ensure that any data used in pattern matching operations is strictly escaped to prevent interpretation as control characters.
Mitigation for this issue involves applying the official patch released in Thunderbird version 153.2 and later, including version 155. These updates correct the regular expression construction logic by properly escaping special characters within the allowed hostname list before they are compiled into a regex pattern. Administrators should ensure that all instances of Thunderbird across their organization are updated to these patched versions immediately. Additionally, reviewing existing configurations for any unusual or overly permissive settings is recommended as a best practice. Future development cycles should enforce strict validation and escaping protocols for all configuration inputs that interact with parsing engines to prevent similar logic errors from recurring in other components of the application.