CVE-2022-27920: 
NixOS vulnerability analysis and mitigation

libkiwix versions 10.0.0 and 10.0.1 contain a Cross-Site Scripting (XSS) vulnerability in the built-in webserver functionality that can be exploited via the search suggestions URL parameter. The vulnerability was discovered in March 2022 and was assigned CVE-2022-27920. The issue was fixed in libkiwix version 10.1.0 (MITRE CVE, Fedora Update).

The vulnerability was introduced in version 10.0.0 when a method was added that explicitly defined no escaping for the searchURL parameter using {{{searchURL}}} syntax. This allowed attackers to inject malicious JavaScript code through the search suggestions URL parameter that would be executed in the context of the web application (GitHub PR).

The XSS vulnerability could allow attackers to execute arbitrary JavaScript code in the context of other users' browsers who visit the affected Kiwix web server. This could potentially lead to session hijacking, credential theft, or other client-side attacks (GitHub PR).

The vulnerability was fixed in libkiwix version 10.1.0 by implementing proper URL encoding for the searchURL parameter before passing it to searchSuggestionHtml. Users should upgrade to version 10.1.0 or later to receive the security fix (Fedora Update).