CVE-2025-5265

MediumCVSS 4.8/10Last modified Oct 5, 2026

Description

Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. *This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
Mozilla	Firefox	—
Mozilla	Thunderbird	—

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1962301Permissions Required
https://www.mozilla.org/security/advisories/mfsa2025-42/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-43/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-44/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-45/
https://www.mozilla.org/security/advisories/mfsa2025-46/

Timeline

Published: May 27, 2025
Last modified: Oct 5, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-526506.1Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0 CVE-2025-526513.5HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system beh CVE-2025-526523.5HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as CVE-2025-526535.4HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorize CVE-2025-526544.6HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handli CVE-2025-526553.1Inclusion of Functionality from Untrusted Control Sphere vulnerability in HCL MyXalytics. v6.6 allows Loading third-party scripts without in CVE-2025-526567.6HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to applica CVE-2025-526573.5HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of character CVE-2025-526584.8HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be CVE-2025-526597.5HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic conte CVE-2025-52664.3Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vuln CVE-2025-526609.8HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthori