CVE-2024-0357: 
NixOS vulnerability analysis and mitigation

A critical vulnerability (CVE-2024-0357) was discovered in coderd-repos Eva version 1.0.0. The vulnerability affects the HTTP POST Request Handler component, specifically in the file /system/traceLog/page. This SQL injection vulnerability was disclosed on January 9, 2024 (NVD, VulDB).

The vulnerability is classified as an SQL injection (CWE-89) that occurs in the HTTP POST Request Handler component. The manipulation of the argument property in the /system/traceLog/page file can lead to SQL injection attacks. The vulnerability has received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating remote exploitability with no privileges or user interaction required (NVD).

The vulnerability allows attackers to potentially execute unauthorized SQL commands on the backend database. Given the CVSS score of 9.8, this vulnerability can lead to complete compromise of system confidentiality, integrity, and availability (NVD).

The vulnerability has been publicly disclosed and exploit code is available. The attack can be executed remotely without requiring any privileges or user interaction, making it highly exploitable (NVD, VulDB).