CVE-2023-44438: 
NixOS vulnerability analysis and mitigation

The vulnerability (CVE-2023-44438) affects Ashlar-Vellum Argon software and was disclosed on November 14, 2023. This is an Uncontrolled Search Path Element vulnerability that allows remote code execution. The issue was initially reported to the vendor on August 1, 2023, and has been assigned a CVSS score of 7.8 (ZDI Advisory).

The vulnerability exists within the parsing of various file types in Ashlar-Vellum Argon. The specific flaw occurs when the process loads a library from an unsecured location. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 with the following vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue was fixed in version 12.0.1204.78 (ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code on affected installations of Ashlar-Vellum Argon. The code execution occurs in the context of the current process, potentially leading to full system compromise (ZDI Advisory).

Exploitation of this vulnerability requires user interaction, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no privileges, but does need user interaction (ZDI Advisory).

The vulnerability has been patched in Ashlar-Vellum Argon version 12.0.1204.78. Users are advised to update to this version or later to mitigate the risk (ZDI Advisory).