CVE-2020-1890: 
NixOS vulnerability analysis and mitigation

A URL validation issue was discovered in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2. The vulnerability, identified as CVE-2020-1890, was disclosed in September 2020 through WhatsApp's security advisory site (NVD, GBHackers).

The vulnerability could cause the recipient of a sticker message containing deliberately malformed data to load an image from a sender-controlled URL without user interaction. The issue has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The vulnerability is classified under CWE-20 (Improper Input Validation) (NVD).

If exploited, this vulnerability could allow an attacker to force victims to load images from attacker-controlled URLs without any user interaction, potentially leading to unauthorized data access or malicious content delivery (NVD).

The vulnerability requires no user interaction and can be triggered through a specially crafted sticker message. The attack vector is network-based, with low attack complexity and no privileges required for exploitation (NVD).

Users should update their WhatsApp for Android to version 2.20.11 or later, and WhatsApp Business for Android to version 2.20.2 or later to protect against this vulnerability (NVD).

WhatsApp disclosed this vulnerability along with five other security bugs through their dedicated security advisory site, demonstrating their commitment to transparency and user security. The company stated, "We take the security of our users very seriously and we provide industry-leading protection for our users around the world" (GBHackers).