CVE-2023-49061: 
NixOS vulnerability analysis and mitigation

CVE-2023-49061 is a security vulnerability discovered in Firefox for iOS versions prior to 120. The vulnerability was disclosed on November 21, 2023, and affects the Reader Mode feature of Firefox's iOS application. This vulnerability allows an attacker to perform HTML template injection via Reader Mode, potentially leading to user information exfiltration (Mozilla Advisory, NVD).

The vulnerability stems from improper handling of the %READER-BYLINE% template in the ReaderMode feature. A previous fix that escaped HTML tags in author names for %READER-CREDITS% was not applied to %READER-BYLINE%, leaving it susceptible to HTML injection attacks. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, no privileges required, and user interaction required (NVD).

The vulnerability allows attackers to perform HTML template injection through the Reader Mode feature, which could lead to the exfiltration of user information. The impact is rated as moderate according to Mozilla's assessment (Mozilla Advisory).

The vulnerability has been fixed in Firefox for iOS version 120. Users are advised to update their Firefox iOS application to version 120 or later to protect against this vulnerability (Mozilla Advisory).