This vulnerability arises from improper escaping of the ampersand character in the “Copy as cURL” feature of Firefox on Windows. An attacker could exploit this by tricking a user into running a maliciously crafted cURL command copied from the browser, which may result in local code execution. The issue is specific to Firefox for Windows and was addressed by Mozilla in Firefox 139 and corresponding ESR and Thunderbird releases. The CVSS v3.1 base score is 4.8, reflecting a medium severity with local attack vector, low privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability.

Successful exploitation could lead to local code execution on the affected Windows system, potentially allowing an attacker to run arbitrary commands with the privileges of the user executing the cURL command. The impact includes limited confidentiality, integrity, and availability consequences. Other Firefox versions and platforms are not affected.

This vulnerability has been fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11. Users and administrators should update affected Firefox for Windows installations to these versions or later to remediate the issue. No additional mitigation steps are required once the update is applied.