The vulnerability arises from insufficient escaping in the “Copy as cURL” feature. An attacker could craft a curl command that, when a user copies it and executes it in a terminal, would run arbitrary code on the local machine. This introduces a possibility of code execution that relies on a user trusting the command, thereby compromising the integrity of the system.

Affected products are Mozilla Firefox and Mozilla Thunderbird. Versions prior to Firefox 141, Firefox ESR 128.13 and 140.1, and Thunderbird 141, 128.13 and 140.1 are vulnerable. The feature is present on both the standard and ESR releases for Windows, macOS, Linux and Android. No specific operating‑system version restrictions beyond those tied to the product are listed.

The CVSS score of 8.1 indicates a high severity. The EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires the user to copy the malicious curl command and run it in a shell, implying a social‑engineering or phishing vector.