No, it isn't, which is insane.

Yes it is. It wasn't for the first couple years but they turned it on a few yrs back. Last time I used Tor browser JS was disabled by default... I'd be surprised if that wasn't the case.

No, it isn't. I just downloaded the latest version of the Tor Browser, 7.5, and while it comes with NoScript installed, it's turned off by default: https://i.imgur.com/7pb7nvI.png

That's been a contentious point for years. The dominant faction of Tor devs fears that Javascript blocking will confuse and frustrate too many users. In the kindest interpretation, that's to protect the most users, notwithstanding that it will get some users pwned.

Less kindly, one could argue that Tor devs want to increase the anonymity set, in order to better hide US government users. That was, after all, one reason why Tor's initial Navy funders agreed with open release of the software.

There are similar issues around other Tor vulnerabilities. Such as how easy it is for apps to bypass Tor. Which has allowed the FBI's phone-home malware to pwn users.

Are you claiming that running an app in an environment where it can access the internet directly counts as a vulnerability in Tor?

Yes, of course it is. Whether it's the Tor Project's fault or the user's fault is a contentious issue.

I disagree, Tor isn't a sandbox or firewall for your apps. If they make undesired network traffic then the vulnerability is in the app (and arguably, the environment it's running in).

Could you please tell me more about the other Tor vulnerabilities?

I'm not aware of known vulnerabilities in Tor itself that devs haven't mitigated, out of usability concerns or whatever. Generally, I consider the focus on Windows users, and the reliance on tweaking Firefox for security, to be vulnerabilities. Also the refusal to compartmentalize the Tor process from userland, either in VMs or in separate hardware. I mean, Whonix has been around for years, and it's not featured (or even mentioned, unless you dig into the wiki) on the Tor Project website. And what about Qubes? Or Tor routers? I mean, they go after people for calling them that, citing their copyright.

I think it imports any JS blocker you might be using on Firefox. For instance, in my case, I installed Tor and when I started it the first time, I saw the 'NoScript' tab enabled.