CVE-2022-1806: 
NixOS vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in the GitHub repository rtxteam/rtx prior to checkpoint_2022-05-18. The vulnerability was assigned CVE-2022-1806 and was disclosed on May 20, 2022. The issue affects the RTX project's codebase (NVD, CVE).

The vulnerability is classified as a Reflected Cross-site Scripting (XSS) issue, categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). It received a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, no privileges required, and user interaction required (NVD).

The vulnerability could allow attackers to execute cross-site scripting attacks, potentially leading to the disclosure of sensitive information and manipulation of web content. The impact is considered moderate with low confidentiality and integrity impact, while availability is not affected (NVD).

The vulnerability requires user interaction to be exploited, with network accessibility and low attack complexity. The issue was documented and a proof of concept was made available (Huntr).

A patch was implemented to address the vulnerability by adding a sanitizer for client-supplied callback function names. The fix was committed to the repository and is available in versions after checkpoint_2022-05-18 (GitHub Patch).