Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2021-46872

Good to know:

icon

Date: January 13, 2023

An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)

Language: NIM

Severity Score

Related Resources (9)

https://github.com/nim-lang/Nim/commit/46275126b89218e64844eee169e8ced05dd0e2d7
https://github.com/nim-lang/Nim/pull/19134
https://github.com/nim-lang/nimforum
https://people.canonical.com/~ubuntu-security/cve/CVE-2021-46872
https://nvd.nist.gov/vuln/detail/CVE-2021-46872
https://github.com/nim-lang/Nim/compare/v1.6.0...v1.6.2
https://security-tracker.debian.org/tracker/CVE-2021-46872
https://forum.nim-lang.org/t/8852
https://www.mend.io/vulnerability-database/CVE-2021-46872

Severity Score

Weakness Type (CWE)

Cross-Site Scripting (XSS)

CWE-79

Top Fix

icon

Upgrade Version

Upgrade to version v1.6.2

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us