CVE-2021-21372
Nimble arbitrary code execution for specially crafted package metadata
- State
- Published
- Severity
- 8.3 High
- Published
- Mar 26, 2021
- Updated
- Aug 3, 2024
- Reserved
- Dec 22, 2020
Description
Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.3 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H | GitHub_M |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
securitynim-lang |
|
References
- https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/
- https://github.com/nim-lang/security/security/advisories/GHSA-rg9f-w24h-962p
- https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130
- https://github.com/nim-lang/nimble/commit/7bd63d504a4157b8ed61a51af47fb086ee818c37
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.