Ophir Lojkine

A command injection issue existed in Web Inspector due to insufficient escaping. Copying a URL from Web Inspector may lead to command injection. This issue was addressed with improved escaping.

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files.

The 'Copy as cURL' feature in the network tab of Devtools did not properly escape the HTTP method of a request. This could be controlled by a website, potentially leading to command injection and arbitrary command execution if a user pasted the command into a terminal.