description: It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View -> Feed article -> Website" or in the standard format of "View -> Feed article -> default format". This vulnerability affects Thunderbird < 52.5.2.
problem types: JavaScript Execution via RSS in mailbox:// origin
affected:
{
product: Thunderbird
vendor: Mozilla
versions:
lessThan: 52.5.2, status: affected, version: unspecified, versionType: custom
}