The vulnerability arises from insufficient escaping of special characters in the "copy as cURL" feature of Mozilla Firefox and Thunderbird. An attacker could craft a malicious cURL command that, if copied and executed by the user, may result in local code execution. This issue was addressed and fixed in Firefox 138 and Thunderbird 138 releases. The CVSS vector indicates the attack requires local access (AV:L), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), with impact on confidentiality and integrity but not availability.

Successful exploitation could lead to local code execution on the user's system, compromising confidentiality and integrity of the affected system. However, exploitation requires the user to be tricked into running a maliciously crafted cURL command, limiting the attack vector to social engineering or user interaction scenarios. There are no reports of active exploitation in the wild.

This vulnerability has been fixed in Mozilla Firefox 138 and Thunderbird 138. Users and administrators should update to these versions or later to remediate the issue. Since the vulnerability requires user interaction to execute the malicious command, educating users to avoid running untrusted commands copied from browsers can also reduce risk. Patch status is confirmed by the official Mozilla advisories.