CVE-2025-8032: XSLT documents could bypass CSP
XSLT document loading did not correctly propagate the source document which bypassed its CSP.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.13 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 141 - Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 141 - Upgrade
Upgrade
Mozilla Firefox ESRto a version that resolves this vulnerability.Fixed in 128.13 - Upgrade
Upgrade
Mozilla Firefox ESRto a version that resolves this vulnerability.Fixed in 140.1 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 141 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 128.13 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 140.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-8032?
CVE-2025-8032 is classified as a moderate severity vulnerability.
How do I fix CVE-2025-8032?
To fix CVE-2025-8032, users should update Mozilla Firefox to version 141 or later, or Firefox ESR to versions 129.0 or later.
Who is affected by CVE-2025-8032?
CVE-2025-8032 affects users of Mozilla Firefox versions prior to 141 and Firefox ESR prior to 128.13 and 140.1.
What type of vulnerability is CVE-2025-8032?
CVE-2025-8032 is a cross-site scripting vulnerability related to XSLT document loading.
Does CVE-2025-8032 allow for a bypass of security restrictions?
Yes, CVE-2025-8032 allows attackers to bypass content security policy (CSP) protections.