CVE-2025-11713: 
NixOS vulnerability analysis and mitigation

CVE-2025-11713 is a security vulnerability discovered in Mozilla products affecting Firefox < 144, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4. The vulnerability was disclosed on October 14, 2025, and involves insufficient escaping in the "Copy as cURL" feature that could potentially lead to code execution on Windows systems (Mozilla Security Advisory).

The vulnerability stems from improper encoding or escaping of output (CWE-116) in the "Copy as cURL" feature. It has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, indicating a high severity issue requiring user interaction (NVD).

The vulnerability could allow an attacker to trick users into executing unexpected code on Windows systems through the "Copy as cURL" feature. This vulnerability specifically affects Windows users of Mozilla products, with no impact on other operating systems (Mozilla Security Advisory).

Mozilla has addressed this vulnerability in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4. Users are advised to update their installations to these versions or later to mitigate the risk (Mozilla Security Advisory).