CVE-2022-25224: 
NixOS vulnerability analysis and mitigation

Proton v0.2.0 contains a cross-site scripting (XSS) vulnerability that can lead to remote code execution (RCE). The vulnerability allows an attacker to create a malicious link inside a markdown file, which when clicked by a victim, opens the site in the current frame. This enables the attacker to execute JavaScript code through the malicious link due to the 'nodeIntegration' configuration being set to on, allowing the webpage to use NodeJS features (Fluid Attacks).

The vulnerability exists due to improper security configuration where 'nodeIntegration' is enabled, allowing webpages to access NodeJS features. When a victim clicks a malicious link in a markdown file, the application opens the site in the current frame, enabling JavaScript code execution. The vulnerability has been assigned a CVSSv3.1 Base Score of 7.1 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N (Fluid Attacks).

The vulnerability allows attackers to execute arbitrary operating system commands through NodeJS features when a user clicks a malicious link. This can lead to complete compromise of the affected system under the user's privileges (Fluid Attacks).

As of May 17, 2022, there was no official patch available to resolve this vulnerability (Fluid Attacks).