Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
Firefox can mis‑rewrite CSS namespaces when pasting style tags
published 4 days ago
Summary
When a user pastes a <style> tag into a rich‑text editor in Firefox or Firefox ESR, the built‑in CSS cleaning code may change the @namespace rule incorrectly. This can cause unexpected styling or allow crafted content to affect the page layout. Upgrade to the latest Firefox release, which includes a fix for this behavior.
What to do
- Update cleanstart firefox to version 71.0.1-r0.
- Update cleanstart firefox-esr to version 68.4.1-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | firefox |
< 71.0.1-r0 Fix: upgrade to 71.0.1-r0
|
| CleanStart | cleanstart | firefox-esr |
< 68.4.1-r0 Fix: upgrade to 68.4.1-r0
|
Original advisory text
When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule
CVE-2019-17016 affects multiple packages. When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. See references for individual vulnerability details.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published31 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2024-UK61359 · OSV
Track software like this
Free during beta