CVE-2025-4084

Description

Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. *This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.* This vulnerability affects Firefox ESR < 128.10, Firefox ESR < 115.23, and Thunderbird < 128.10.

Reserved 2025-04-29 | Published 2025-04-29 | Updated 2025-05-02 | Assigner mozilla

Problem types

Potential local code execution in "copy as cURL" command

Product status

Any version before 128.10
affected

Any version before 115.23
affected

Any version before 128.10
affected

Credits

Ameen Basha M K

References

bugzilla.mozilla.org/...i?bug_id=1949994%2C1956698%2C1960198

www.mozilla.org/security/advisories/mfsa2025-29/

www.mozilla.org/security/advisories/mfsa2025-30/

www.mozilla.org/security/advisories/mfsa2025-32/

cve.org (CVE-2025-4084)

nvd.nist.gov (CVE-2025-4084)

Download JSON