Thunderbird versions prior to 128.10.1 and 138.0.1 contain a vulnerability in the handling of the X-Mozilla-External-Attachment-URL header. This flaw allows an attacker to craft a nested email attachment with a spoofed content type that Thunderbird may render as HTML rather than PDF. Because Thunderbird auto-saves attachments to /tmp and links them via the file:/// protocol, embedded JavaScript can execute in the file context without requiring the user to download the file. This vulnerability is addressed in Thunderbird 128.10.1 and 138.0.1.