CVE-2021-21372CWE-20CWE-74

Nimble arbitrary code execution for specially crafted package metadata

High · published March 26, 2021

CVSS v3.1
8.3
EPSS
4%
Percentile
89.5
In the wild
Unconfirmed
What it is

Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03618 · 89.5th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2021-03-26T21:20Z
EPSS history
Timeline
  • 26 MAR 21:20Z
    Nimble arbitrary code execution for specially crafted package metadata
    cvelistv5