CVE-2021-21372

Published March 26th, 2021

View on NVD ↗

CVSS v3

8.3

HIGH

CVSS v2

6.8

MEDIUM

Affected

PROJECT

Description

Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.

nim-lang/security

Embargoed security issues that will be made public after a fix is made available. Use https://github.com/nim-lang/security/security

GitHub