CVE-2022-26174: 
NixOS vulnerability analysis and mitigation

A remote code execution (RCE) vulnerability was discovered in Beekeeper Studio v3.2.0 that allows attackers to execute arbitrary code via crafted payloads injected into the display fields. The vulnerability was identified and reported on February 21, 2022, and was assigned CVE-2022-26174 (MITRE, NVD).

The vulnerability exists in the display fields of Beekeeper Studio v3.2.0 where input validation is insufficient. Attackers can exploit this by creating a fake MySQL server that executes malicious code when users attempt to connect and execute SQL queries. The attack vector involves injecting arbitrary code through the display fields, which are not properly filtered (GitHub Issue).

When successfully exploited, this vulnerability allows attackers to execute arbitrary code on the target system. The impact is particularly severe as it can be triggered by normal database operations, such as executing SELECT queries, potentially compromising the entire system running Beekeeper Studio (GitHub Issue).

A proof of concept exploit has been demonstrated, showing that the vulnerability can be triggered by executing any SELECT query after connecting to a malicious MySQL server. The attack requires the user to connect to a compromised or malicious database server (GitHub Issue).