CVE-2020-17368: 
NixOS vulnerability analysis and mitigation

CVE-2020-17368 affects Firejail through version 0.9.62, a sandbox program designed to restrict the running environment of untrusted applications. The vulnerability was discovered by Tim Starling and disclosed in August 2020 (NVD).

The vulnerability stems from Firejail's mishandling of shell metacharacters during the use of the --output or --output-stderr option. When redirecting output, Firejail concatenates all command line arguments into a single string that is passed to a shell. The vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

An attacker who has control over the command line arguments of the sandboxed application could exploit this vulnerability to execute arbitrary commands, potentially compromising the security of the system (Debian Security).

The vulnerability was fixed in Firejail version 0.9.62.4. Multiple Linux distributions have released security updates to address this issue: Debian released version 0.9.58.2-2+deb10u1 for Debian 10 Buster, Fedora released version 0.9.62.4 for Fedora 31 and 32, and Gentoo released version 0.9.64 (Gentoo Security, Fedora Update).