CVE-2022-23857: 
NixOS vulnerability analysis and mitigation

The vulnerability (CVE-2022-23857) affects Navidrome versions before 0.47.5, specifically in the model/criteria/criteria.go component. The vulnerability was discovered and disclosed on January 24, 2022. This SQL injection vulnerability occurs when processing crafted Smart Playlists, allowing authenticated users to exploit the system (NVD, AttackerKB).

The vulnerability is a SQL injection flaw with a CVSS v3 Base Score of 6.5, indicating medium severity. The attack vector is network-based, requires low privileges, and no user interaction. The vulnerability exists in the Smart Playlists processing functionality, where input validation was insufficient to prevent SQL injection attacks (NVD).

If exploited, an authenticated user could extract arbitrary data from the database, including sensitive information from the user table such as encrypted passwords (AttackerKB).

The vulnerability was patched in Navidrome version 0.47.5. Users are advised to upgrade to this version or later to mitigate the risk. The fix involves improved input validation in the Smart Playlists processing functionality (Github Release).