The vulnerability identified as CVE-2025-8030 involves insufficient escaping in the “Copy as cURL” feature of Mozilla Firefox and Thunderbird. This flaw could potentially be leveraged to trick users into executing unexpected code, representing a user-assisted code execution risk. The issue has been fixed in Firefox 141 and corresponding ESR and Thunderbird versions. The CVSS 3.1 base score is 8.1, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction, and resulting in high confidentiality and integrity impact without affecting availability. The vendor advisory explicitly states the fix is included in Firefox 141 and ESR 128.13 releases.

If exploited, this vulnerability could allow an attacker to trick a user into executing unexpected code via the “Copy as cURL” feature, potentially compromising confidentiality and integrity of user data. However, exploitation requires user interaction. There are no reports of active exploitation in the wild. The vulnerability is rated high severity with a CVSS score of 8.1.

This vulnerability has been fixed by Mozilla in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official update.