CVE-2025-11713

Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code on Windows. This did not affect the application when running on other operating systems. This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1986142	Issue Tracking Permissions Required
https://www.mozilla.org/security/advisories/mfsa2025-81/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-83/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-84/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-85/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mozilla:firefox:::::esr:::*
	cpe:2.3:a:mozilla:firefox:::::-:::*
	cpe:2.3:a:mozilla:thunderbird::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::

History

13 Apr 2026, 15:16

Type	Values Removed	Values Added
Summary	(en) Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code on Windows. This did not affect the application when running on other operating systems. This vulnerability affects Firefox < 144, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4.	(en) Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code on Windows. This did not affect the application when running on other operating systems. This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.

14 Nov 2025, 16:15

Type	Values Removed	Values Added
Summary	(en) Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code on Windows. This did not affect Firefox running on other operating systems. This vulnerability affects Firefox < 144, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4.	(en) Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code on Windows. This did not affect the application when running on other operating systems. This vulnerability affects Firefox < 144, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4.

20 Oct 2025, 20:19

Type	Values Removed	Values Added
First Time		Mozilla Mozilla firefox Mozilla thunderbird
CPE		cpe:2.3:a:mozilla:thunderbird:::::::: cpe:2.3:a:mozilla:firefox:::::-:::* cpe:2.3:a:mozilla:firefox:::::esr:::*
References	~~() https://bugzilla.mozilla.org/show_bug.cgi?id=1986142 -~~	() https://bugzilla.mozilla.org/show_bug.cgi?id=1986142 - Issue Tracking, Permissions Required
References	~~() https://www.mozilla.org/security/advisories/mfsa2025-81/ -~~	() https://www.mozilla.org/security/advisories/mfsa2025-81/ - Vendor Advisory
References	~~() https://www.mozilla.org/security/advisories/mfsa2025-83/ -~~	() https://www.mozilla.org/security/advisories/mfsa2025-83/ - Vendor Advisory
References	~~() https://www.mozilla.org/security/advisories/mfsa2025-84/ -~~	() https://www.mozilla.org/security/advisories/mfsa2025-84/ - Vendor Advisory
References	~~() https://www.mozilla.org/security/advisories/mfsa2025-85/ -~~	() https://www.mozilla.org/security/advisories/mfsa2025-85/ - Vendor Advisory

15 Oct 2025, 14:15

Type	Values Removed	Values Added
CWE		CWE-116
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.1

14 Oct 2025, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-10-14 13:15

Updated : 2026-04-13 15:16

NVD link : CVE-2025-11713

Mitre link : CVE-2025-11713

CVE.ORG link : CVE-2025-11713

JSON object : View

Products Affected

mozilla

thunderbird
firefox

CWE

CWE-116

Improper Encoding or Escaping of Output

8.1 /10