CVE-2025-8030CWE-94code-injection

CVE-2025-8030

High · published July 23, 2025

CVSS v3.1
8.1
EPSS
0%
Percentile
27.4
In the wild
Unconfirmed
What it is

Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00350 · 27.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-07-23T01:15Z
Affected products (6)
ProductVersionsFixed in
mozilla/firefox< 128.13.0128.13.0
mozilla/firefox< 141.0141.0
mozilla/firefox≥ 140.0, < 140.1.0140.1.0
mozilla/thunderbird< 128.13.0128.13.0
mozilla/thunderbird< 141.0141.0
mozilla/thunderbird≥ 140.0, < 140.1.0140.1.0
References (8)
https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.mozilla.org/show_bug.cgi?id=1968414 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-56/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-58/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-59/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-61/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-62/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-63/ · [email protected]
EPSS history
Timeline
  • 22 JUL 20:49Z
    Potential user-assisted code execution in “Copy as cURL” command
    cvelistv5