CVEvulnerability

CVE-2026-44658

2.4 LOW Published 2026-05-11 Modified 2026-10-26 Official page ↗
Status
Deferred
Published
2026-05-11
Last modified
2026-10-26
Assigner
[email protected]
CVSS 3.1 ([email protected])
2.4 LOW — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-20

Description

Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links inside the feed are not subject to the same restriction. The provider maps each RSS/Atom item link into item.url, filters only for presence and date, and returns the item list. The live-folder manager later creates pinned lazy tabs from these values with gBrowser.addTrustedTab(item.url, ...). This vulnerability is fixed in 1.19.12b.

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References