Search for vulnerabilities
Vulnerability details: VCID-kx62-2e3g-f7gd
Vulnerability ID VCID-kx62-2e3g-f7gd
Aliases CVE-2025-5264
Summary Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-116 Improper Encoding or Escaping of Output
System Score Found at
cvssv3 6.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-5264.json
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-5264
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-5264
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-5264
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-5264
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-5264
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-5264
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-5264
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-5264
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-5264
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-5264
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-5264
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-5264
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-5264
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-5264
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-5264
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-5264
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-5264
cvssv3.1 4.8 https://bugzilla.mozilla.org/show_bug.cgi?id=1950001
ssvc Track https://bugzilla.mozilla.org/show_bug.cgi?id=1950001
cvssv3.1 4.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2025-42
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2025-43
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2025-44
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2025-45
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2025-46
cvssv3.1 4.8 https://www.mozilla.org/security/advisories/mfsa2025-42/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-42/
cvssv3.1 4.8 https://www.mozilla.org/security/advisories/mfsa2025-43/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-43/
cvssv3.1 4.8 https://www.mozilla.org/security/advisories/mfsa2025-44/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-44/
cvssv3.1 4.8 https://www.mozilla.org/security/advisories/mfsa2025-45/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-45/
cvssv3.1 4.8 https://www.mozilla.org/security/advisories/mfsa2025-46/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-46/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-5264.json
https://api.first.org/data/v1/epss?cve=CVE-2025-5264
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5264
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2368751 https://bugzilla.redhat.com/show_bug.cgi?id=2368751
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
CVE-2025-5264 https://nvd.nist.gov/vuln/detail/CVE-2025-5264
mfsa2025-42 https://www.mozilla.org/en-US/security/advisories/mfsa2025-42
mfsa2025-42 https://www.mozilla.org/security/advisories/mfsa2025-42/
mfsa2025-43 https://www.mozilla.org/en-US/security/advisories/mfsa2025-43
mfsa2025-43 https://www.mozilla.org/security/advisories/mfsa2025-43/
mfsa2025-44 https://www.mozilla.org/en-US/security/advisories/mfsa2025-44
mfsa2025-44 https://www.mozilla.org/security/advisories/mfsa2025-44/
mfsa2025-45 https://www.mozilla.org/en-US/security/advisories/mfsa2025-45
mfsa2025-45 https://www.mozilla.org/security/advisories/mfsa2025-45/
mfsa2025-46 https://www.mozilla.org/en-US/security/advisories/mfsa2025-46
mfsa2025-46 https://www.mozilla.org/security/advisories/mfsa2025-46/
RHSA-2025:8293 https://access.redhat.com/errata/RHSA-2025:8293
RHSA-2025:8308 https://access.redhat.com/errata/RHSA-2025:8308
RHSA-2025:8341 https://access.redhat.com/errata/RHSA-2025:8341
RHSA-2025:8598 https://access.redhat.com/errata/RHSA-2025:8598
RHSA-2025:8599 https://access.redhat.com/errata/RHSA-2025:8599
RHSA-2025:8607 https://access.redhat.com/errata/RHSA-2025:8607
RHSA-2025:8608 https://access.redhat.com/errata/RHSA-2025:8608
RHSA-2025:8628 https://access.redhat.com/errata/RHSA-2025:8628
RHSA-2025:8629 https://access.redhat.com/errata/RHSA-2025:8629
RHSA-2025:8630 https://access.redhat.com/errata/RHSA-2025:8630
RHSA-2025:8631 https://access.redhat.com/errata/RHSA-2025:8631
RHSA-2025:8642 https://access.redhat.com/errata/RHSA-2025:8642
RHSA-2025:8756 https://access.redhat.com/errata/RHSA-2025:8756
RHSA-2025:9071 https://access.redhat.com/errata/RHSA-2025:9071
RHSA-2025:9072 https://access.redhat.com/errata/RHSA-2025:9072
RHSA-2025:9073 https://access.redhat.com/errata/RHSA-2025:9073
RHSA-2025:9074 https://access.redhat.com/errata/RHSA-2025:9074
RHSA-2025:9075 https://access.redhat.com/errata/RHSA-2025:9075
RHSA-2025:9076 https://access.redhat.com/errata/RHSA-2025:9076
RHSA-2025:9077 https://access.redhat.com/errata/RHSA-2025:9077
RHSA-2025:9155 https://access.redhat.com/errata/RHSA-2025:9155
show_bug.cgi?id=1950001 https://bugzilla.mozilla.org/show_bug.cgi?id=1950001
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-5264.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1950001
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T15:13:14Z/ Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1950001
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L Found at https://www.mozilla.org/security/advisories/mfsa2025-42/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T15:13:14Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-42/
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L Found at https://www.mozilla.org/security/advisories/mfsa2025-43/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T15:13:14Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-43/
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L Found at https://www.mozilla.org/security/advisories/mfsa2025-44/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T15:13:14Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-44/
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L Found at https://www.mozilla.org/security/advisories/mfsa2025-45/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T15:13:14Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-45/
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L Found at https://www.mozilla.org/security/advisories/mfsa2025-46/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T15:13:14Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-46/
Exploit Prediction Scoring System (EPSS)
Percentile 0.01825
EPSS Score 0.00015
Published At June 12, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-05-27T20:08:35.161589+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2025/mfsa2025-42.yml 36.0.0