CVE-2022-39906: 
NixOS vulnerability analysis and mitigation

A command injection vulnerability was discovered in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The vulnerability requires authentication, but an attacker can craft a link that they can pass to a logged in administrator of the blog software. This leads to the immediate execution of the provided commands when the link is accessed by the authenticated administrator (GitHub Security Lab).

The vulnerability exists in the IndieAuth functionality of Haven and allows command injection that leads to remote code execution when an authenticated administrator accesses a specially crafted link. The vulnerability has been assigned CVE-2022-39906 and has a CVSS v3.1 base score of 2.3 LOW (AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) according to Samsung Mobile's assessment (Samsung Mobile Security).

If successfully exploited, an attacker could execute arbitrary commands on the server when an authenticated administrator clicks on a maliciously crafted link. This could lead to a full system compromise within the context of the application (GitHub Security Lab).

The issue has been addressed in commit c52f07c. Users are advised to upgrade to the patched version. There are no known workarounds for this vulnerability (GitHub Security Lab).