CVE-2026-113867: Stanza injection in XMPP chat
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 158.0.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.5.1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:153.5.1esr-1~deb12u1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:153.5.1esr-1~deb13u1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.6.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 158.0.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 153.5.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
Who is exposed to this issue?
Only Thunderbird users who use the chat feature with XMPP accounts are affected. Thunderbird installations not using XMPP chat are not affected by this issue.
What does an attacker need to exploit it?
A remote XMPP user must send a crafted request to the target. No user interaction is required because Thunderbird can echo attacker-controlled values in automatic replies.
What could exploitation allow?
The attacker can cause arbitrary XMPP stanzas to be injected into the victim's connection and processed by the server as if the victim sent them. This can allow messages to be sent or contact and subscription settings to be changed on the user's behalf.
Which Thunderbird releases contain the fix?
The vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.