CVE-2025-5264

Potential local code execution in “Copy as cURL” command

View on CVE.org
Published May 27, 2025 CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

Analysis

AI-generated

Technical impact

The flaw in the “Copy as cURL” feature arises from inadequate handling of newline characters, allowing an attacker to embed malicious command fragments into the generated cURL string. When a user mistakenly executes the copied command, the embedded code can run with the user’s privileges, resulting in local code execution. This vulnerability combines unescaped input and command‑injection issues, classified under CWE‑116 and CWE‑77.

Affected Systems

The vulnerability affects Mozilla Firefox versions prior to 139, including Firefox ESR 115.24 and ESR 128.11, as well as Thunderbird versions prior to 139 and Thunderbird ESR 128.11.

Risk and Exploitability

The CVSS score of 4.8 indicates medium impact when the flaw is used. The EPSS score of less than 1% shows a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction, typically through a social engineering scenario where a malicious site or email tempts the victim to run the copied command. The attack vector is local, leveraging the user’s own system. Consequently, while the impact can be severe, the likelihood of real‑world attacks is currently low.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Firefox to version 139 or later, or to Firefox ESR 115.24/128.11, and upgrade Thunderbird to version 139 or later or to Thunderbird ESR 128.11; this applies the official patch that removes the newline escape flaw.
  • If an upgrade cannot be performed immediately, disable or avoid using the "Copy as cURL" command until the patch is installed; this eliminates the vulnerable entry point.
  • Monitor for phishing or malicious sites that offer automated cURL commands and implement user training and web‑filtering controls to reduce the chance that a user will execute a malicious copy.

Generated by OpenCVE AI on April 20, 2026 at 20:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4191-1 firefox-esr security update
Debian DLA Debian DLA DLA-4194-1 thunderbird security update
Debian DSA Debian DSA DSA-5926-1 firefox-esr security update
Debian DSA Debian DSA DSA-5932-1 thunderbird security update
EUVD EUVD EUVD-2025-16338 Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability affects Firefox < 139, Firefox ESR < 115.24, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11.
Ubuntu USN Ubuntu USN USN-7663-1 Thunderbird vulnerabilities
History
Type Values Removed Values Added
Description Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability affects Firefox < 139, Firefox ESR < 115.24, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title firefox: thunderbird: Potential local code execution in “Copy as cURL” command Potential local code execution in “Copy as cURL” command
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Type Values Removed Values Added
Description Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability affects Firefox < 139, Firefox ESR < 115.24, and Firefox ESR < 128.11. Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability affects Firefox < 139, Firefox ESR < 115.24, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11.
References
Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_aus:8.2
cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_e4s:8.8
cpe:/a:redhat:rhel_e4s:9.2
cpe:/a:redhat:rhel_tus:8.6
cpe:/a:redhat:rhel_tus:8.8
Vendors & Products Redhat rhel Aus
Redhat rhel Tus
Type Values Removed Values Added
First Time appeared Redhat rhel E4s
Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_e4s:9.0
cpe:/a:redhat:rhel_eus:9.4
Vendors & Products Redhat rhel E4s
Redhat rhel Eus
Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
Vendors & Products Mozilla
Mozilla firefox
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10.0
Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Type Values Removed Values Added
Title firefox: thunderbird: Potential local code execution in “Copy as cURL” command
Weaknesses CWE-116
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Weaknesses CWE-77
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability affects Firefox < 139, Firefox ESR < 115.24, and Firefox ESR < 128.11.
References
Earlier changes (9)
Weaknesses
  • CWE-116

    Improper Encoding or Escaping of Output

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

Sources

Status
PUBLISHED
Assigner
mozilla
Published
Updated
Apr 13, 2026, 2:27 PM
Reserved
May 27, 2025, 12:29 PM

View source JSON

Updated
Nov 3, 2025, 8:05 PM

JSON

Status
Modified
Published
May 27, 2025, 1:15 PM
Modified
Oct 5, 2026, 3:10 PM

View source JSON

Severity
Moderate
Public date
May 27, 2025, 12:29 PM

View source Bugzilla JSON

Updated
Apr 20, 2026, 8:45 PM

JSON