CVE-2022-22744

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 91.5 Firefox versions prior to 96 Thunderbird versions prior to 91.5

Description The issue arises from the "Copy as curl" feature in DevTools, where the constructed curl command is not properly escaped for PowerShell, potentially leading to command injection if pasted into a PowerShell prompt. This could allow a remote attacker to execute arbitrary commands in the system if the copied data is inserted into the PowerShell command line. The bug specifically affects Thunderbird for Windows, with other operating systems being unaffected.

Recommendations For Firefox ESR versions prior to 91.5, update to version 91.5 or later. For Firefox versions prior to 96, update to version 96 or later. For Thunderbird versions prior to 91.5, update to version 91.5 or later. As a temporary workaround, consider avoiding the use of the "Copy as curl" feature in DevTools for these versions until a patch is applied.