Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. *This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox ESR 128.10, Firefox ESR 115.23, and Thunderbird 128.10.
CVSS Details
- CVSS 3.1 Base Score: 5.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Mfsa2025 29 | — | Upgrade to Mozilla Firefox ESR version 128.10Upgrade to the latest version of Mozilla Firefox | Apr 30, 2025 | Apr 29, 2025 |
| Mfsa2025 30 | — | Upgrade to Mozilla Firefox ESR version 115.23Upgrade to the latest version of Mozilla Firefox | Apr 30, 2025 | Apr 29, 2025 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 128.10Upgrade to the latest version of Mozilla Thunderbird | Apr 30, 2025 | Apr 29, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 29, 2025 |
| Suse | — | Upgrade mozillafirefox-branding-upstreamUpgrade MozillaFirefox-develUpgrade MozillaThunderbirdUpgrade MozillaThunderbird-translations-otherUpgrade MozillaFirefox-translations-otherUpgrade MozillaFirefox-translations-commonUpgrade MozillaThunderbird-translations-commonUpgrade MozillaFirefox | May 5, 2025 | Apr 29, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub