Local Code Execution Vulnerability in Firefox and Thunderbird by Mozilla
CVE-2025-4089

5.1MEDIUM

Key Information:

Vendor: Mozilla
Status: Firefox; Thunderbird
Vendor: CVE Published:; 29 April 2025

What is CVE-2025-4089?

A vulnerability exists in Mozilla's Firefox and Thunderbird, wherein insufficient escaping of special characters in the 'copy as cURL' feature may allow attackers to manipulate users into executing crafted commands. This exploitation could lead to local code execution on the affected systems, posing significant security risks to users who may unwittingly run harmful scripts.

Affected Version(s)

Firefox < 138

Thunderbird < 138

References

https://bugzilla.mozilla.org/buglist.cgi?bug_id=1949994%2...

https://www.mozilla.org/security/advisories/mfsa2025-28/

https://www.mozilla.org/security/advisories/mfsa2025-31/

CVSS V3.1

Score:

5.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Local

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Apr 29, 2025
Vulnerability Reserved
Apr 29, 2025

Credit

Ameen Basha M K