CVE-2025-5264
Potential local code execution in “Copy as cURL” command
- State
- Published
- Severity
- 4.8 Medium
- Published
- May 27, 2025
- Updated
- Apr 13, 2026
- Reserved
- May 27, 2025
Description
Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.8 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L | CISA-ADP |
Weaknesses
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected Products
| Product | Versions |
|---|---|
FirefoxMozilla |
|
ThunderbirdMozilla |
|
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1950001
- https://www.mozilla.org/security/advisories/mfsa2025-42/
- https://www.mozilla.org/security/advisories/mfsa2025-43/
- https://www.mozilla.org/security/advisories/mfsa2025-44/
- https://www.mozilla.org/security/advisories/mfsa2025-45/
- https://www.mozilla.org/security/advisories/mfsa2025-46/
- https://lists.debian.org/debian-lts-announce/2025/05/msg00046.html
- https://lists.debian.org/debian-lts-announce/2025/05/msg00043.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.