CVE-2025-5265: 
NixOS vulnerability analysis and mitigation

CVE-2025-5265 is a moderate severity vulnerability discovered in Firefox's "Copy as cURL" feature, reported by security researcher Ameen Basha M K and publicly disclosed on May 27, 2025. The vulnerability specifically affects Firefox for Windows versions below 139, Firefox ESR versions below 115.24, and Firefox ESR versions below 128.11. Other versions of Firefox are unaffected (Mozilla Advisory, NVD).

The vulnerability stems from insufficient escaping of the ampersand character in the "Copy as cURL" feature. It has been classified as CWE-77 (Improper Neutralization of Special Elements used in a Command Injection) and assigned a CVSS 3.1 Base Score of 4.8 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L (Wiz, NVD).

If successfully exploited, the vulnerability could potentially lead to local code execution on the user's system. The impact is specifically limited to Firefox installations on Windows platforms (Wiz).

The vulnerability requires local access and user interaction to be exploited. An attacker could trick a user into using the malformed cURL command, which could then lead to code execution on the user's system (Mozilla Advisory).

Mozilla has addressed this vulnerability by releasing patches in Firefox 139, Firefox ESR 115.24, and Firefox ESR 128.11. Users are strongly advised to update their Firefox installations to these versions or newer to mitigate the risk (Mozilla Advisory).