CVE-2025-4089: Potential local code execution in "copy as cURL" command
Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability was fixed in Firefox 138 and Thunderbird 138.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 138 - Upgrade
Upgrade
ubuntu/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.7.1+build1-0ubuntu0.22.04.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 138 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0-1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 138
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-4089?
The severity of CVE-2025-4089 is considered to be critical due to its potential for local code execution.
How do I fix CVE-2025-4089?
To fix CVE-2025-4089, update Firefox or Thunderbird to the latest version that is 138 or higher.
What versions of software are affected by CVE-2025-4089?
CVE-2025-4089 affects Firefox versions lower than 138 and Thunderbird versions lower than 138.
What is the impact of exploiting CVE-2025-4089?
Exploiting CVE-2025-4089 could allow an attacker to execute local commands on a user's system.
Who is at risk from CVE-2025-4089?
Users of outdated versions of Firefox and Thunderbird are at risk from CVE-2025-4089.