Approved changes feed: RSS · Atom
cpe:2.3:a:nim-lang:nim:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Nim Lang (43225b88-c491-57f8-8598-b27f35d0c2d2) |
|---|---|
| Product | Nim (fa74eb53-36ae-59cf-95f6-cba92eeb960f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/nim |
purl2cpe | 2026-06-01 10:11:00.234607 |
pkg:deb/ubuntu/nim |
purl2cpe | 2026-06-01 10:11:00.234610 |
pkg:docker/nimlang/nim |
purl2cpe | 2026-06-01 10:11:00.234613 |
pkg:github/nim-lang/nim |
purl2cpe | 2026-06-01 10:11:00.234616 |
pkg:rpm/opensuse/nim |
purl2cpe | 2026-06-01 10:11:00.234619 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-46872 |
vulnerable | 2026-06-08 05:38:06.226323 |
Details available
An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)
Published: 2023-01-13T00:00:00.000Z
Updated: 2025-04-07T19:13:15.282Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-29495 |
vulnerable | 2026-06-08 05:31:26.465531 |
Nim stdlib httpClient does not validate peer certificates by default
MEDIUM (5.9)
Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verification was disabled by default. Users can upgrade to version 1.4.2 to receive a patch or, as a workaround, set "verifyMode = CVerifyPeer" as documented.
Published: 2021-05-07T15:15:10.000Z
Updated: 2024-08-03T22:11:05.438Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21374 |
vulnerable | 2026-06-08 05:29:11.771512 |
Nimble fails to validate certificates due to insecure httpClient defaults
HIGH (8.1)
Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.
Published: 2021-03-26T21:25:14.000Z
Updated: 2024-08-03T18:09:15.923Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21373 |
vulnerable | 2026-06-08 05:29:11.771079 |
Nimble falls back to insecure http url when fetching packages
HIGH (7.5)
Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.
Published: 2021-03-26T21:25:19.000Z
Updated: 2024-08-03T18:09:15.923Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21372 |
vulnerable | 2026-06-08 05:29:11.770579 |
Nimble arbitrary code execution for specially crafted package metadata
HIGH (8.3)
Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.
Published: 2021-03-26T21:20:15.000Z
Updated: 2024-08-03T18:09:15.920Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-15694 |
vulnerable | 2026-06-08 05:19:26.346430 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-15693 |
vulnerable | 2026-06-08 05:19:26.345964 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-15692 |
vulnerable | 2026-06-08 05:19:26.345569 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-15690 |
vulnerable | 2026-06-08 05:19:26.344972 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.