CVE-2025-8030

Description

Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.

Reserved 2025-07-22 | Published 2025-07-22 | Updated 2025-07-22 | Assigner mozilla

Problem types

Potential user-assisted code execution in “Copy as cURL” command

Product status

Any version before 141
affected

Any version before 128.13
affected

Any version before 140.1
affected

Any version before 141
affected

Any version before 128.13
affected

Any version before 140.1
affected

Credits

Ameen Basha M K

References

bugzilla.mozilla.org/show_bug.cgi?id=1968414

www.mozilla.org/security/advisories/mfsa2025-56/

www.mozilla.org/security/advisories/mfsa2025-58/

www.mozilla.org/security/advisories/mfsa2025-59/

www.mozilla.org/security/advisories/mfsa2025-61/

www.mozilla.org/security/advisories/mfsa2025-62/

www.mozilla.org/security/advisories/mfsa2025-63/

cve.org (CVE-2025-8030)

nvd.nist.gov (CVE-2025-8030)

Download JSON