CVE-2023-25344: 
NixOS vulnerability analysis and mitigation

An issue was discovered in swig-templates through 2.0.4 and swig through 1.4.2 that allows attackers to execute arbitrary code via crafted Object.prototype anonymous function. The vulnerability was disclosed on March 15, 2023 and assigned identifier CVE-2023-25344 (NVD).

The vulnerability exists in the template rendering functionality, specifically in how the include tag handles file operations. The issue occurs in the include.js file where code splicing is performed without proper validation. When processing template includes, the code performs string concatenation that can be manipulated to execute arbitrary JavaScript code through Object.prototype constructor injection (GitHub Issue). The vulnerability has been assigned a CVSS v3.1 base score of 9.8 CRITICAL with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows remote attackers to execute arbitrary code on affected systems. This could lead to complete system compromise, as attackers can run commands with the privileges of the application running the swig template engine (NVD).

Proof of concept code has been publicly disclosed demonstrating how an attacker can exploit this vulnerability through template injection. The exploit involves using the include tag with a crafted payload that leverages Object.prototype constructor to execute arbitrary system commands (GitHub Issue).