CVE-2025-4084

What it actually does

Insufficient escaping of special characters in the copy-as-cURL feature allows a crafted request to produce a command line that executes arbitrary code when pasted and run on Windows.

Why it matters to the business

Attackers who trick Windows users into copying and executing a malicious cURL command can run code on those users' systems, potentially leading to data theft or further compromise; the issue is limited to Firefox on Windows and does not affect other platforms.

How an attack unfolds

An attacker crafts a network request containing special characters that are not properly escaped by the copy-as-cURL feature. The attacker then tricks a user (for example via a malicious link or page) into using the copy-as-cURL action on that request and pasting the resulting command into a Windows terminal, causing local code execution.

How to fix it

Upgrade Firefox to ESR 128.10 or ESR 115.23 and Thunderbird to 128.10 on all Windows systems. Until patches are applied, avoid using the copy-as-cURL feature on untrusted requests.

How to confirm the fix worked

Verify installed versions match or exceed the fixed releases listed above; re-test the copy-as-cURL feature with specially crafted requests containing shell metacharacters to confirm escaping now occurs.

Typical attack path

1. Craft a request containing unescaped special characters designed to break out of the cURL command
2. Lure the target user into inspecting the request in Firefox developer tools on Windows
3. Convince the user to select copy-as-cURL and paste/run the resulting command
4. Achieve local code execution on the user's system

How to detect it

Review Windows command-line and PowerShell logs for unexpected cURL invocations containing unusual quoting or chained commands; correlate with Firefox developer-tools usage where possible.

What your security team should do

• Immediately deploy the listed ESR and Thunderbird updates to all Windows endpoints
• Communicate the risk to Windows Firefox users and advise against pasting untrusted copy-as-cURL output
• Monitor for future updates as the vulnerability is Windows-specific