cbcvebase.
CVE-2025-8032
published 2025-07-22

CVE-2025-8032: XSLT document loading did not correctly propagate the source document which bypassed its CSP. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13…

PriorityP338high8.1CVSS 3.1
AVNACLPRNUIRSUCHIHAN
EPSS
0.30%
22.5th percentile
XSLT document loading did not correctly propagate the source document which bypassed its CSP. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

Affected

20 ranges
VendorProductVersion rangeFixed in
debianfirefox< firefox 141.0-1 (sid)firefox 141.0-1 (sid)
debianfirefox-esr< firefox 141.0-1 (sid)firefox 141.0-1 (sid)
debianthunderbird< firefox 141.0-1 (sid)firefox 141.0-1 (sid)
mozillafirefox< 128.13.0128.13.0
mozillafirefox< 141.0141.0
mozillafirefox
mozillafirefox>= 140.0 < 140.1.0140.1.0
mozillathunderbird< 128.13.0128.13.0
mozillathunderbird< 141.0141.0
mozillathunderbird>= 0 < 1:128.13.0esr-1~deb11u11:128.13.0esr-1~deb11u1
mozillathunderbird>= 0 < 1:128.13.0esr-1~deb12u11:128.13.0esr-1~deb12u1
mozillathunderbird>= 0 < 1:128.13.0esr-11:128.13.0esr-1
mozillathunderbird>= 0 < 1:128.13.0esr-11:128.13.0esr-1
mozillathunderbird>= 140.0 < 140.1.0140.1.0
msrccbl2_cyrus-sasl_2.1.27-10_on_cbl_mariner_2.0
msrccbl_mariner_1.0_arm
msrccbl_mariner_1.0_x64
msrccbl_mariner_2.0_arm
msrccbl_mariner_2.0_x64
msrccm1_cyrus-sasl_2.1.27-4_on_cbl_mariner_1.0

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
osv8.1HIGH
vendor_debian8.1HIGH
vendor_redhat8.1HIGH
vendor_msrc7.0HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.