{"id":"CVE-2026-118179","kind":"vulnerability","aliases":["CVE-2026-118179"],"related":[],"title":"Thunderbird: news links make it connect to arbitrary hosts and send commands","description":"Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.","summary":"Clicking a news: or snews: link with a crafted message-ID made Thunderbird open a connection to whatever host and port the link named, even if it was not a configured news server. Line breaks in the message-ID were passed to the server unchanged, so the link could send arbitrary commands to services reachable from the user's network, and snews: links connected without TLS.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","email","other","thunderbird"],"not_affected_if":["fixed-version","no-news-links"],"how_to_check":"- Check the Thunderbird version under Help > About Thunderbird, or run `thunderbird --version` on the machine\n- Confirm whether the team uses news (NNTP) accounts at all, since the flaw is triggered through news: and snews: links","fix":"- Move Thunderbird to `153.6` or later on the 153 line, or to `159` or later\n- Until patched, avoid clicking news: and snews: links from untrusted sources","status":"open","published_at":"2026-10-27T19:17:29+00:00","first_seen_at":"2026-10-27T19:33:18+00:00","triaged_at":"2026-10-27T19:35:11+00:00","updated_at":"2026-10-27T19:35:11+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-27T19:35:11Z","model":"claude-haiku-5-5","output":{"fix":"- Move Thunderbird to `153.6` or later on the 153 line, or to `159` or later\n- Until patched, avoid clicking news: and snews: links from untrusted sources","reach":"local","title":"Thunderbird: news links make it connect to arbitrary hosts and send commands","impact":"medium","summary":"Clicking a news: or snews: link with a crafted message-ID made Thunderbird open a connection to whatever host and port the link named, even if it was not a configured news server. Line breaks in the message-ID were passed to the server unchanged, so the link could send arbitrary commands to services reachable from the user's network, and snews: links connected without TLS.","category":"other","nicknames":[],"who_cares":["thunderbird","desktop","email"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker sends commands to internal network services via crafted link","analyst_note":"Sources give no CVSS score or exploitation status; confirm severity and which exact Thunderbird builds are fixed at the NVD page.","how_to_check":"- Check the Thunderbird version under Help > About Thunderbird, or run `thunderbird --version` on the machine\n- Confirm whether the team uses news (NNTP) accounts at all, since the flaw is triggered through news: and snews: links","needs_analyst":true,"not_affected_if":["fixed-version","no-news-links"],"who_is_affected":"Anyone running Thunderbird builds before the fixed versions who can be sent or can open a news: or snews: link. The exposure is on desktop machines where the user clicks such a link, and the reachable targets are services on that user's network. Teams that never use news links and do not run Thunderbird on managed desktops can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":3366,"output_tokens":624,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118179':15A,18A '-2026':14A,17A '153.6':174C '159':171C 'addit':156C 'arbitrari':8A,75B,145C 'ask':107C 'break':58B,127C 'click':23B,91C 'command':12A,76B,146C 'configur':54B,123C 'connect':6A,39B,88B,105C,162C 'could':73B,143C 'craft':31B,141C 'cve':13A,16A 'desktop':19B 'email':20B 'even':48B,117C 'fix':168C 'given':113C 'host':9A,42B,110C 'id':34B,63B,102C,132C 'line':57B,126C 'link':3A,28B,46B,72B,87B,96C,116C,142C,158C 'made':35B,103C 'make':4A 'messag':33B,62B,101C,131C 'message-id':32B,61B,100C,130C 'name':47B 'network':84B,154C 'news':2A,25B,55B,93C,124C 'open':37B 'pass':65B 'port':44B,112C 'reachabl':79B,149C 'referenc':98C 'send':11A,74B,144C 'sent':134C 'server':56B,68B,125C,137C,161C 'servic':78B,148C 'snew':27B,86B,95C,157C 'thunderbird':1A,22B,36B,104C,170C,173C 'tls':90B,164C 'unchang':69B 'unmodifi':138C 'user':82B,152C 'vulner':166C 'whatev':41B 'without':89B,106C,163C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Thunderbird builds before the fixed versions who can be sent or can open a news: or snews: link. The exposure is on desktop machines where the user clicks such a link, and the reachable targets are services on that user's network. Teams that never use news links and do not run Thunderbird on managed desktops can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T19:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118179","severity":null,"published_at":"2026-10-27T19:17:29+00:00","modified_at":"2026-10-27T19:17:29+00:00","first_seen_at":"2026-10-27T19:33:18+00:00","fetched_at":"2026-10-27T19:33:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}