CVE-2019-9804

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the execution of unintended additional bash script commands if the URL was maliciously crafted. This is the result of an issue with the native version of Bash on macOS. *Note: This issue only affects macOS. Other operating systems are unaffected.*. This vulnerability affects Firefox < 66.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Apr 26, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-98059.8A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential CVE-2019-98067.5A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed and cannot be immediaCVE-2019-98074.3When arbitrary text is sent over an FTP connection and a page reload is initiated, it is possible to create a modal alert message with this CVE-2019-98085.3If WebRTC permission is requested from documents with data: or blob: URLs, the permission notifications do not properly display the originatCVE-2019-98097.5If the source for resources on a page is through an FTP connection, it is possible to trigger a series of modal alert messages for these resCVE-2019-98108.8Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overfloCVE-2019-98118.3As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a brCVE-2019-98129.3Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firCVE-2019-98138.8Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read anCVE-2019-98149.8Mozilla developers and community members reported memory safety bugs present in Firefox 66. Some of these bugs showed evidence of memory corCVE-2019-98158.1If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.CVE-2019-98165.9A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypas