CVE-2023-28394: 
NixOS vulnerability analysis and mitigation

Beekeeper Studio versions prior to 3.9.9 contains a code injection vulnerability that allows a remote authenticated attacker to execute arbitrary JavaScript code with the privilege of the application on the PC where the affected product is installed. The vulnerability was discovered in May 2023 and assigned identifier CVE-2023-28394 (JVN Report).

The vulnerability is classified as a code injection vulnerability (CWE-74) with a CVSS v3.1 base score of 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD). The vulnerability allows authenticated attackers to inject and execute malicious JavaScript code within the application context.

A successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary JavaScript code with the privileges of the Beekeeper Studio application on the affected system. This can further lead to execution of arbitrary OS commands on the target machine (JVN Report).

The vulnerability requires authentication for exploitation, indicating that an attacker must first have valid credentials to access the application. The attack complexity is considered low, requiring no special conditions or preparation for exploitation (NVD).

The vendor has released version 3.9.9 of Beekeeper Studio that contains a fix for this vulnerability. Users are advised to update to the latest version according to the information provided by the developer (JVN Report).