CVE-2020-26956

—

CVSS 3.1

6.1 medium

EPSS

1%p67

Published

Dec 9, 2020 (Dec 9, 2020)

Modified

Jun 17, 2026

Description

In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Vendors: mozilla
Products: firefox, firefox esr, thunderbird
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news0 stories

No ingested article mentions this CVE yet.