CVE-2025-11713CWE-116

CVE-2025-11713

High · published October 14, 2025

CVSS v3.1

8.1

EPSS

Percentile

20.1

In the wild

Unconfirmed

What it is

Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code on Windows. This did not affect the application when running on other operating systems. This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.

The record

Technical detail

CVSS v3.1: 8.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.00287 · 20.1th percentile
Weakness: CWE-116 · Improper Encoding or Escaping of Output
Published: 2025-10-14T17:15Z

Affected products (4)

Product	Versions	Fixed in
mozilla/firefox	< 140.4.0	140.4.0
mozilla/firefox	< 144.0	144.0
mozilla/thunderbird	< 140.4.0	140.4.0
mozilla/thunderbird	≥ 141.0, < 144.0	144.0

References (5)

https://bugzilla.mozilla.org/show_bug.cgi?id=1986142 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-81/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-83/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-84/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-85/ · [email protected]

EPSS history

Timeline

14 OCT 12:27Z
Potential user-assisted code execution in “Copy as cURL” command
cvelistv5