CVE-2020-12393: 
NixOS vulnerability analysis and mitigation

CVE-2020-12393 is a security vulnerability discovered in Firefox's DevTools 'Copy as cURL' feature. The vulnerability was reported by David Yesland and disclosed on May 5, 2020. It affects Firefox versions prior to 76 and Firefox ESR versions prior to 68.8, specifically impacting Windows operating systems (Mozilla Advisory).

The vulnerability stems from improper escaping of the HTTP method in the 'Copy as cURL' feature of Firefox's DevTools network tab. When a website controls the HTTP method of a request, the lack of proper escaping of special characters, particularly the dollar sign ($), could lead to potential command injection. The vulnerability was assigned a moderate severity rating (Mozilla Advisory, Bugzilla).

If exploited, this vulnerability could result in command injection and arbitrary command execution when a user copies a malicious request using the 'Copy as cURL' feature and pastes it into a terminal. The impact is limited to Windows operating systems and requires user interaction (Mozilla Advisory).

The vulnerability can be exploited by creating a request containing unencoded $() characters in portions that don't get URL encoded, such as HTTP headers. When such a request is copied using 'Copy as cURL (Windows)' and pasted into PowerShell, it could lead to command execution (Bugzilla).

The vulnerability was patched in Firefox 76 and Firefox ESR 68.8. The fix involved properly escaping the dollar sign for curl commands on Windows to prevent command injection possibilities (Bugzilla).