CVE-2018-16983: Noscript

Critical severity, CVSS 9.8. EPSS: 3.1% chance of exploitation in the next 30 days.

NoScript Classic before 5.1.8.7, as used in Tor Browser 7.x and other products, allows attackers to bypass script blocking via the text/html;/json Content-Type value.

Affected products

• Noscript Noscript: before 5.1.8.7 (fixed in 5.1.8.7)
• Torproject Tor Browser: from 7.0.0, up to and including 7.0.11

Published 2018-09-13. Last modified 2026-06-17.