The flaw in the “Copy as cURL” feature arises from inadequate handling of newline characters, allowing an attacker to embed malicious command fragments into the generated cURL string. When a user mistakenly executes the copied command, the embedded code can run with the user’s privileges, resulting in local code execution. This vulnerability combines unescaped input and command‑injection issues, classified under CWE‑116 and CWE‑77.

The vulnerability affects Mozilla Firefox versions prior to 139, including Firefox ESR 115.24 and ESR 128.11, as well as Thunderbird versions prior to 139 and Thunderbird ESR 128.11.

The CVSS score of 4.8 indicates medium impact when the flaw is used. The EPSS score of less than 1% shows a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction, typically through a social engineering scenario where a malicious site or email tempts the victim to run the copied command. The attack vector is local, leveraging the user’s own system. Consequently, while the impact can be severe, the likelihood of real‑world attacks is currently low.