CVE-2025-1015 PoC — Unsanitized address book fields

Source

Associated Vulnerability

Description

an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript

Readme

CVE-2025-1015: Unsanitized address book fields on  thunderbird thunderbird_esr128 and below 
an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript



<img width="412" alt="cve-new" src="https://github.com/user-attachments/assets/ca138a57-b042-4e26-8c38-9ed03bca50bf" />

File Snapshot

 [4.0K]  /data/pocs/c6d5b609391f4d24d41f7486894a0b68d0bebdde
├── [ 832]  poc.py
└── [ 553]  README.md

0 directories, 2 files

Remarks