CVE-2019-9804: OS Command Injection
In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the execution of unintended additional bash script commands if the URL was maliciously crafted. This is the result of an issue with the native version of Bash on macOS. Note: This issue only affects macOS. Other operating systems are unaffected.
Other sources
In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the execution of unintended additional bash script commands if the URL was maliciously crafted. This is the result of an issue with the native version of Bash on macOS. Note: This issue only affects macOS. Other operating systems are unaffected.. This vulnerability affects Firefox < 66.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-9804.
What is the severity of CVE-2019-9804?
The severity of CVE-2019-9804 is critical with a severity value of 9.8.
Which software is affected by CVE-2019-9804?
Mozilla Firefox versions up to and excluding 66.0 and Apple Mac OS X are affected by CVE-2019-9804.
How can I fix CVE-2019-9804?
Update Mozilla Firefox to version 66 or later to fix CVE-2019-9804.
What is the Common Weakness Enumeration (CWE) ID for CVE-2019-9804?
The CWE ID for CVE-2019-9804 is CWE-78.