Log in Start free

Vulnerability · Published May 27, 2025 · Assigned by mozilla

CVE-2025-5265Potential local code execution in “Copy as cURL” command

Medium 4.8

In plain English

A medium-severity command injection in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.2%top 89.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. *This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:22.04:LTSmozjs102no fix listedUBUNTU-CVE-2025-5265
Ubuntu:24.04:LTSmozjs102no fix listedUBUNTU-CVE-2025-5265
Ubuntu:24.04:LTSmozjs115no fix listedUBUNTU-CVE-2025-5265
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2025-5265
Ubuntu:22.04:LTSmozjs91no fix listedUBUNTU-CVE-2025-5265
Ubuntu:22.04:LTSthunderbird1:128.12.0+build1-0ubuntu0.22.04.1UBUNTU-CVE-2025-5265
Ubuntu:22.04:LTSthunderbird1:128.12.0+build1-0ubuntu0.22.04.1USN-7663-1

Affected products (as reported)

VendorProductVersions
Mozilla Firefox see references
Mozilla Thunderbird see references

Weakness: CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

References