CVE-2020-26956: 
NixOS vulnerability analysis and mitigation

CVE-2020-26956 is a cross-site scripting (XSS) vulnerability discovered in Mozilla Firefox, Firefox ESR, and Thunderbird versions prior to 83, 78.5, and 78.5 respectively. The vulnerability was discovered by Irvan Kurniawan (@sourc7) and disclosed on November 17, 2020. The issue occurs when removing HTML elements during sanitization, where existing SVG event handlers would be retained, potentially leading to XSS attacks (Mozilla Advisory).

The vulnerability stems from a parsing and sanitization issue where removing HTML elements during sanitization would keep existing SVG event handlers active. The issue specifically involves the interaction between SVG elements and the HTML sanitization process. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility with required user interaction (NVD).

The vulnerability could allow attackers to execute cross-site scripting attacks through paste operations (both manual and via clipboard API). While the impact is rated as moderate, in Thunderbird this vulnerability cannot be exploited through email as scripting is disabled when reading mail, but remains a potential risk in browser or browser-like contexts (Mozilla Advisory).

The vulnerability can be exploited when a user copies content from a malicious website and pastes it into a vulnerable application. A proof-of-concept exploit involves crafting specific SVG elements with event handlers that survive the sanitization process (Bugzilla).

The vulnerability was fixed in Firefox 83, Firefox ESR 78.5, and Thunderbird 78.5. The fix involved two main parts: removing attributes from descendants when setting sanitized style and parsing into an inert document. Users are advised to upgrade to these versions or later to mitigate the vulnerability (Mozilla Advisory).