CVE-2019-17020

CVE-2019-17020 describes a vulnerability in Firefox versions prior to 72 where Content Security Policies (CSPs) applied to XML files fail to extend to embedded XSL stylesheets. This allows an attacker to bypass CSP restrictions by injecting malicious JavaScript within an XSL stylesheet, potentially leading to cross-site scripting (XSS) or other client-side attacks. The vulnerability has a CVSS score of 6.5 (Medium), indicating a network-based attack requiring user interaction, with a high impact on integrity. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.