CVE-2025-8030 Details
Description
Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
A vulnerability allowing potential user-assisted code execution has been identified in the 'Copy as cURL' feature of Mozilla Firefox and Thunderbird. This issue arises from insufficient escaping, which could be exploited to trick users into executing unexpected code. The vulnerability affects multiple versions of Firefox and Thunderbird, including Firefox prior to 141, Firefox ESR prior to 128.13 and 140.1, as well as Thunderbird versions prior to 141, 128.13 and 140.1.
Users can update to Firefox 141 or Thunderbird 141 to address this vulnerability. Firefox ESR users should update to version 128.13 or 140.1.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 24, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| mozilla firefox | < 128.13.0 < 141.0 >= 140.0, < 140.1.0 |
CPE
Remediation
| |
| mozilla thunderbird | < 128.13.0 < 141.0 >= 140.0, < 140.1.0 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 13, 2026 | CVE Modified | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Jul 28, 2025 | Initial Analysis | [email protected] |
| Jul 23, 2025 | CVE Modified | CISA-ADP |
| Jul 22, 2025 | New CVE Received | [email protected] |