CVE-2025-14328: 
NixOS vulnerability analysis and mitigation

CVE-2025-14328 is a privilege escalation vulnerability in the Netmonitor component of Mozilla Firefox and Thunderbird, specifically affecting the "Copy As Curl (Windows)" feature. The flaw allows a malicious web page to inject arbitrary commands via newline/whitespace characters in HTTP request body data, which are then executed when a user copies a network request as a curl command on Windows. It was reported by security researcher Ameen Basha M K and disclosed on December 9, 2025. Affected versions include Firefox before 146, Firefox ESR before 140.6, Thunderbird before 146, and Thunderbird ESR before 140.6. The CVSS v3.1 base score is 8.8 (High) (Mozilla Advisory Firefox 146, Mozilla Advisory ESR 140.6).

The root cause is insufficient sanitization of whitespace-like control characters (e.g., tab \t, carriage return \r, newline \n) in HTTP request body content when generating curl command strings in the Firefox DevTools Netmonitor component (CWE-78: Improper Neutralization of Special Elements used in an OS Command). When a user uses the "Copy As Curl" feature on Windows, the generated command string is not properly escaped — double quotes are escaped with ^ but tab characters cause the command to include local file names enclosed in quotes, and \n or \r characters break the command into new lines, enabling injection of arbitrary OS commands. The fix replaces whitespace-like characters with a simple space using a JavaScript regex patch (Mozilla Bugzilla). A proof-of-concept payload was included in the original bug report: a fetch() call with a body containing '\t \rcalc.exe "\t \n' that, when copied as curl and pasted into a Windows command prompt, executes calc.exe (Mozilla Bugzilla).

Successful exploitation allows a remote attacker to achieve arbitrary OS command execution on the victim's Windows machine when the victim uses the Firefox DevTools Netmonitor "Copy As Curl" feature on a malicious or attacker-controlled network request. Additionally, the vulnerability enables local file name and directory path disclosure to the attacker through the tab character injection mechanism. The impact is rated moderate by Mozilla, as it requires user interaction (the victim must actively use the Copy As Curl feature), but the consequences include full code execution in the context of the user's account (Mozilla Advisory Firefox 146, Mozilla Bugzilla).

A working proof-of-concept was included in the original bug report submitted by researcher Ameen Basha M K, demonstrating arbitrary command execution (launching calc.exe) on Windows via the Copy As Curl feature. Exploitation requires user interaction — the victim must open DevTools, observe a network request from a malicious page, and use the "Copy As Curl" feature, then paste and execute the result in a Windows command prompt. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.037% (very low), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Mozilla Bugzilla, Mozilla Advisory Firefox 146).

1. Set up a malicious page: The attacker hosts a web page that executes a crafted fetch() request with a body containing whitespace-like control characters designed to inject OS commands, e.g.:

fetch("/", {
  "credentials": "omit",
  "headers": { "Content-Type": "text/plain" },
  "body": '\t \rcalc.exe "\t \n',
  "method": "POST"
});

2. Lure the victim: The attacker tricks a developer or technical user into visiting the malicious page while Firefox DevTools is open or can be opened.
3. Victim opens DevTools Netmonitor: The victim opens Firefox Developer Tools (F12) and navigates to the Network Monitor tab, where the crafted POST request appears.
4. Victim uses Copy As Curl: The victim right-clicks the malicious network request and selects "Copy As Curl (Windows)".
5. Victim pastes into command prompt: The victim pastes the copied curl command into a Windows command prompt (cmd.exe). Due to the injected \r or \n characters, the pasted content breaks into multiple lines, with the attacker-controlled command (e.g., calc.exe) executing as a separate command.
6. Arbitrary code execution: The injected command runs in the context of the victim's Windows user account, enabling further payload delivery, data exfiltration, or persistence (Mozilla Bugzilla).

• Network: Unusual POST requests to attacker-controlled domains with body content containing tab (\t), carriage return (\r), or newline (\n) characters, potentially visible in proxy or firewall logs.
• Process: Unexpected processes (e.g., calc.exe, cmd.exe, powershell.exe, or other executables) spawned from a Windows command prompt session shortly after a user pastes clipboard content.
• Logs: Windows Event Logs (Security, Application) showing process creation events for unexpected executables initiated by a user's interactive shell session.
• File System: Presence of new files, scripts, or executables in user-writable directories created around the time of the suspected exploitation event.

Mozilla has released patched versions addressing this vulnerability: Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird ESR 140.6. Users should update to these versions immediately. As a behavioral workaround, users — especially developers — should avoid pasting curl commands copied from Firefox DevTools into a Windows command prompt when visiting untrusted websites, and should inspect copied commands before execution. No configuration-based workaround within Firefox is available; upgrading is the recommended remediation (Mozilla Advisory Firefox 146, Mozilla Advisory ESR 140.6).

Mozilla rated this vulnerability as "moderate" impact and awarded a security bounty to the reporter, Ameen Basha M K, through their client bug bounty program. The CIS (Center for Internet Security) issued an advisory noting that multiple vulnerabilities in Mozilla products, including this one, could allow for arbitrary code execution (CIS Advisory). The vulnerability received standard coverage from Linux distribution security teams (Red Hat, Debian, SUSE, Oracle, Rocky Linux, AlmaLinux, Amazon Linux) who issued downstream patches. No significant social media controversy or notable researcher commentary beyond the original bug report was identified.