CVE-2022-39362: 
NixOS vulnerability analysis and mitigation

Metabase, a data visualization software, was found to have a vulnerability (CVE-2022-39362) where unsaved SQL queries were automatically executed prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. The vulnerability was disclosed on October 26, 2022 (AttackerKB).

The vulnerability stems from the auto-execution of ad-hoc native queries in the native query editor. When a user accessed an unsaved native query, the system would automatically execute it without requiring explicit user confirmation. The vulnerability has a CVSS v3.1 Base Score of 8.8 (High), with attack vector being Network, attack complexity Low, and privileges required Low (AttackerKB).

The automatic execution of unsaved SQL queries could potentially lead to unauthorized data access, data manipulation, or system compromise if malicious SQL queries were crafted and executed without user awareness (GitHub Advisory).

The vulnerability has been patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. In the patched versions, Metabase no longer automatically executes ad-hoc native queries. Instead, the native editor shows the query and gives users the option to manually run the query if desired (AttackerKB).