The bug originates from insufficient escaping of special characters in the "copy as cURL" feature, which allows an attacker to inject shell code when a user copies a generated cURL command. The result is the execution of arbitrary commands on the victim’s machine, providing the attacker with the privileges of the user. The weakness aligns with CWE‑116 (Improper Encoding of Quotations and Escape Characters) and CWE‑138 (Improper Validation of Interpreted Characters).

The vulnerability was identified only in Mozilla Firefox for Windows, affecting all ESR releases prior to 115.23 and prior to 128.10. It is also present in Mozilla Thunderbird ESR versions prior to 128.10.

The CVSS score of 5.7 classifies the issue as moderate; the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a victim to be tricked into using a maliciously crafted "copy as cURL" command; the attack vector is therefore largely user‑interactive and local. Should exploitation succeed, it would enable the attacker to execute code with the current user’s permissions, potentially leading to full system compromise if user privileges are high.