CVE-2021-21372: Nimble arbitrary code execution for specially crafted package metadata

Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2021-21372

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Nimble arbitrary code execution for specially crafted package metadata

Source: NVD (National Vulnerability Database)

Vulnerability Description

Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.

Source: NVD (National Vulnerability Database)

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Source: NVD (National Vulnerability Database)

Vulnerability Type

输入验证不恰当

Source: NVD (National Vulnerability Database)

Vulnerability Title

Nimble 操作系统命令注入漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Nim是Nim社区的一种静态类型的编程语言。Nimble是开源的Nim编程语言的软件包管理器。 Nimble 1.2.10 版本和 1.4.4 版本存在操作系统命令注入漏洞，攻击者可利用该漏洞可以在包中创建一个恶意条目，执行任意命令。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
nim-lang	security	< 1.2.10	-

II. Public POCs for CVE-2021-21372

#	POC Description	Source Link	Shenlong Link

AI-Generated POCPremium

No public POC found.

III. Intelligence Information for CVE-2021-21372

Please Login to view more intelligence information

https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/x_refsource_MISC
https://github.com/nim-lang/security/security/advisories/GHSA-rg9f-w24h-962px_refsource_CONFIRM
https://github.com/nim-lang/nimble/commit/7bd63d504a4157b8ed61a51af47fb086ee818c37x_refsource_MISC
https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2021-21372

IV. Related Vulnerabilities

Same product: security

Same vendor: nim-lang

Same weakness: CWE-20

V. Comments for CVE-2021-21372

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

I. Basic Information for CVE-2021-21372

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2021-21372

III. Intelligence Information for CVE-2021-21372

IV. Related Vulnerabilities

V. Comments for CVE-2021-21372

Leave a comment