The vulnerability identified as CVE-2025-11713 involves insufficient escaping in the “Copy as cURL” feature of Mozilla Firefox on Windows platforms. This flaw could allow an attacker to craft content that, when copied and executed by a user, results in unexpected code execution. The issue is specific to Windows and does not impact Firefox on other operating systems. Mozilla addressed this vulnerability in Firefox 144 and Firefox ESR 140.4 releases. The CVSS v3.1 base score is 8.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity but no impact on availability.

Successful exploitation could lead to user-assisted code execution on Windows systems running vulnerable versions of Firefox. This could compromise the confidentiality and integrity of the affected system. The vulnerability does not affect Firefox on non-Windows platforms. There are no known exploits in the wild at the time of publication.

Mozilla has released official fixes for this vulnerability in Firefox 144 and Firefox ESR 140.4. Users and administrators should update affected Firefox installations to these versions or later to remediate the issue. Since the vulnerability requires user interaction, educating users to be cautious when using the “Copy as cURL” feature on Windows can reduce risk until updates are applied.