CVE-2021-21372 HIGH

CVE-2021-21372: Nimble arbitrary code execution for specially crafted package metadata

Vendor Nim-Lang
Product security
Weakness CWE-20 · Input validation
Published March 26, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.

Key dates

02Disclosure timeline

March 26, 2021 CVE published
August 3, 2024 Record updated