CVE-2020-12391: 
NixOS vulnerability analysis and mitigation

CVE-2020-12391 is a security vulnerability discovered in Mozilla Firefox versions prior to 76. The vulnerability was reported by Giorgio Maone and was disclosed on May 5, 2020. It affects the Content Security Policy (CSP) implementation in Firefox, specifically related to how object elements handle data URLs (Mozilla Advisory).

The vulnerability stems from a flaw where documents formed using data: URLs in an object element failed to inherit the Content Security Policy (CSP) of the creating context. This implementation error allowed the execution of scripts that should have been blocked, although they were executed with a unique opaque origin. The vulnerability was assigned a CVSS v3.1 score of 7.5 (HIGH) and a CVSS v2.0 score of 5.0 (MEDIUM) (NVD Results).

The vulnerability could allow attackers to bypass Content Security Policy restrictions, potentially enabling the execution of unauthorized scripts. While the scripts would run with a unique opaque origin, this still represents a security policy bypass that could compromise the intended security controls of affected websites (Mozilla Advisory).

The vulnerability was rated as having moderate impact by Mozilla. The exploit requires crafting specific data URLs within object elements to bypass CSP restrictions. No evidence of active exploitation in the wild was reported at the time of disclosure (Mozilla Advisory).

The vulnerability was fixed in Firefox version 76. Users and organizations running affected versions of Firefox should upgrade to Firefox 76 or later to receive the security fix. The fix involves making object elements properly inherit CSP when dealing with opaque origins (Mozilla Bug).