CVE-2022-30763: 
NixOS vulnerability analysis and mitigation

Janet before version 1.22.0 contains a vulnerability in its array handling functionality that was discovered in May 2022. The vulnerability affects the core array module of the Janet programming language interpreter (NVD, Conviso Blog).

The vulnerability stems from improper validation of array indices when creating arrays with negative values using array/new-filled function. When a negative count is provided, the array is created with array->data set to NULL, while both array->count and array->capacity retain the negative value. This implementation flaw can lead to out-of-bounds memory access (Conviso Blog).

The vulnerability can be exploited to achieve out-of-bounds read and write operations in memory. After bypassing the initial NULL pointer through array/ensure, an attacker can read from and write to memory locations relative to the array->data address, potentially leading to information disclosure or arbitrary code execution (Conviso Blog).

The vulnerability has been patched in Janet version 1.22.0. Users should upgrade to this version or later to address the security issue (Janet Release).