Mozilla Firefox and Thunderbird 'Copy as cURL' Feature Local Code Execution Vulnerability

A local code execution vulnerability has been identified in the 'copy as cURL' feature of Mozilla Firefox and Thunderbird. This issue arises from inadequate escaping of special characters, particularly the ampersand, which could allow an attacker to manipulate the command and execute code on the user's system. The vulnerability is present in Firefox for Windows and affects several versions of Firefox ESR and Thunderbird.

Impact

Exploitation of this vulnerability could lead to unauthorized local code execution on the user's system.

Remediation

Users can update to Firefox ESR 128.10, Firefox ESR 115.23, or Thunderbird 128.10 to address this vulnerability.