CVE-2021-45463: 
NixOS vulnerability analysis and mitigation

CVE-2021-45463 affects the load_cache functionality in GEGL (Generic Graphics Library) versions before 0.4.34. The vulnerability was disclosed on December 23, 2021, and impacts GEGL's image processing framework, which is notably used in GIMP versions before 2.10.30. The vulnerability exists in the magick-load component where pathnames in constructed command lines are not properly escaped or filtered (NVD).

The vulnerability stems from improper handling of shell expansion in the magick-load component when processing pathnames. The issue occurs specifically in the load_cache function where the system library function is used for executing ImageMagick convert fallback operations. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

The vulnerability could allow an attacker to execute arbitrary shell commands through specially crafted pathnames when GEGL processes images. This could lead to unauthorized access, data manipulation, or system compromise with the same privileges as the application processing the image (Red Hat).

The vulnerability has been fixed in GEGL version 0.4.34 and GIMP version 2.10.30. Users are advised to upgrade to these or later versions. Various Linux distributions have also released security updates to address this vulnerability, including Fedora and Red Hat Enterprise Linux (GIMP News, Fedora Update).