CVE-2025-5264

MediumCVSS 4.8/10Last modified Oct 5, 2026

Description

Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
May 27, 2025
Last modified
Oct 5, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-526404.7HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separatCVE-2025-526415.3HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure ofCVE-2025-526426.5HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour. ExCVE-2025-526437.8HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environmCVE-2025-526448.2HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. The absence of proper auditing mechCVE-2025-526455.3HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verificatiCVE-2025-526465.3HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. ImproCVE-2025-526476.1The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning AttacksCVE-2025-526489.8HCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of image signing may allow the use of unverifieCVE-2025-526495.3HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature. Predictable identifiers may allow an attackeCVE-2025-52654.8Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this commanCVE-2025-526506.1Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0
CVE-2025-5264: Medium severity, CVSS 4.8 | Vulnix