CVE-2025-14329: 
NixOS vulnerability analysis and mitigation

CVE-2025-14329 is a privilege escalation vulnerability in the Netmonitor component of Firefox and Thunderbird, specifically affecting the "Copy as cURL (Windows CMD)" feature in DevTools. Discovered by external researcher satrya wira yudha and disclosed on December 9, 2025, the flaw allows arbitrary code execution when a user copies a crafted network request as a cURL command and pastes it into a Windows Command Prompt. Affected versions include Firefox before 146, Firefox ESR before 140.6, Thunderbird before 146, and Thunderbird ESR before 140.6. The CVSS v3.1 base score is 8.8 (High) per Feedly/NVD, though ENISA rates it 9.8 (Critical) (Mozilla Advisory Firefox 146, Mozilla Advisory ESR 140.6, Mozilla Bugzilla).

The root cause is improper neutralization of special elements in the Netmonitor's "Copy as cURL (cmd)" output generation (CWE-78, OS Command Injection / improper escaping). When Firefox DevTools generates a Windows CMD-compatible cURL command from a captured network request, it attempts to escape ASCII control characters using the caret (^) character — the standard CMD escape character. However, the escaping logic is flawed: escaping a control character with ^ causes the caret itself to escape the next character rather than the control character, breaking the escape sequence. An attacker can craft HTTP request bodies containing control characters (e.g., \x0e, \x0f, \x1a) combined with newlines to inject arbitrary CMD commands into the clipboard output. When a developer copies the request as cURL and pastes it into a Windows CMD window, the injected commands execute with the user's privileges (Mozilla Bugzilla). The fix removes the erroneous caret-escaping of Unicode control characters entirely.

Successful exploitation allows an attacker to achieve arbitrary code execution on the Windows system of any Firefox or Thunderbird user who uses the DevTools Netmonitor's "Copy as cURL (cmd)" feature on a maliciously crafted request. The attacker can execute arbitrary commands (e.g., launching processes, downloading malware, exfiltrating data) with the privileges of the user running the browser. Confidentiality, integrity, and availability are all fully impacted, and the attack could serve as an initial foothold for lateral movement within a network (Mozilla Advisory Firefox 146, Mozilla Bugzilla).

1. Craft a malicious HTTP request: Set up a web server or page that causes the victim's browser to make a fetch request with a body containing embedded control characters and CMD commands, e.g.:

fetch("/copyme", {
  method: "POST",
  body: "query=evil\ncmd /c calc.exe\x0e\ncmd /c calc.exe\x0f"
});

2. Lure the developer target: Deliver the malicious page to a developer who uses Firefox DevTools (e.g., via a phishing link, a compromised website, or a malicious dependency in a development environment).
3. Wait for DevTools interaction: The developer opens DevTools (F12), navigates to the Network Monitor tab, and observes the captured request to the attacker-controlled endpoint.
4. Trigger the copy action: The developer right-clicks the request and selects "Copy as cURL (cmd)" (Windows-specific option), placing the maliciously crafted cURL command on the clipboard.
5. Achieve code execution: The developer pastes the clipboard content into a Windows CMD prompt and presses Enter. Due to the broken escape sequence, the injected CMD commands (e.g., cmd /c calc.exe) execute with the developer's user privileges (Mozilla Bugzilla).

• Network: Unusual outbound connections from a developer workstation shortly after DevTools usage; HTTP requests to unfamiliar endpoints with POST bodies containing non-printable/control characters.
• Process: Unexpected child processes spawned from cmd.exe or powershell.exe that are not part of normal developer workflows (e.g., calc.exe, curl.exe downloading from external IPs, script interpreters).
• Logs: Windows Event Logs (Security, Event ID 4688) showing new process creation events with unusual parent-child relationships (e.g., cmd.exe spawning unexpected executables after a paste operation).
• File System: Unexpected files downloaded or created in user-writable directories (e.g., %TEMP%, %APPDATA%) around the time of DevTools usage.

Mozilla has released patched versions that fix this vulnerability: Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird ESR 140.6. The fix removes the incorrect caret-escaping of Unicode control characters in the cURL command generation logic. Users and organizations should update to these versions immediately. As a workaround prior to patching, developers should avoid using the "Copy as cURL (cmd)" feature on requests from untrusted or unknown websites, and should inspect clipboard contents before pasting into a CMD prompt (Mozilla Advisory Firefox 146, Mozilla Advisory ESR 140.6).

Mozilla awarded a security bug bounty to the external reporter (satrya wira yudha) for responsibly disclosing this vulnerability. The bug was classified as sec-moderate internally and received a sec-bounty+ flag. Multiple Linux distributions (Red Hat, Debian, Oracle Linux, Rocky Linux, AlmaLinux, SUSE, Slackware) issued downstream advisories and package updates. The CIS also published an advisory noting multiple vulnerabilities in Mozilla products that could allow arbitrary code execution. No significant independent researcher commentary or social media discussion beyond standard vulnerability tracking was observed (Mozilla Bugzilla, CIS Advisory).