CVE-2025-5271: Devtools' preview ignored CSP headers
Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 139 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 139 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 139
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-5271?
The severity of CVE-2025-5271 is considered critical due to the potential for content injection attacks.
How do I fix CVE-2025-5271?
To fix CVE-2025-5271, update your Firefox browser to version 139 or later.
Who is affected by CVE-2025-5271?
CVE-2025-5271 affects all versions of Firefox prior to version 139.
What impact does CVE-2025-5271 have?
CVE-2025-5271 could allow attackers to inject malicious content during response previews in Devtools.
What does CSP stand for in the context of CVE-2025-5271?
In the context of CVE-2025-5271, CSP stands for Content Security Policy, which is bypassed during response previews.