The vulnerability originates from insufficient escaping within the Copy as cURL command in Mozilla applications. When a user copies a request containing crafted characters and pastes it into a terminal or command prompt on Windows, the shell may interpret them as executable code, leading to unintended command execution. This flaw affords an attacker the ability to trigger arbitrary local code execution, effectively compromising the user's system whenever they interact with the sanitized cURL string. The weakness is a classic example of improper input escaping, reflected in CWE-116 and CWE-88.

Mozilla Firefox versions prior to 144 and Firefox ESR 140.4, as well as Mozilla Thunderbird versions prior to 144 and Thunderbird ESR 140.4, are affected. The flaw only impacts Windows builds of these products; it does not affect macOS or Linux builds or Mozilla applications running on non‑Windows platforms. Users with legacy builds should check whether they use the Copy as cURL feature in a Windows environment.

The CVSS score of 8.1 classifies this as a high‑severity vulnerability. However, the EPSS score is below 1 %, indicating a very low probability of widespread exploitation in the near term. The flaw is not listed in CISA’s KEV catalog. It requires a user to copy the malicious cURL line and paste it into a Windows command shell, which is a user‑assisted attack vector. Successful exploitation would give an attacker local privileges on the victim machine and the ability to execute arbitrary commands.