Lucene search

GoogleOSV:CVE-2020-15692

HistoryAug 14, 2020 - 7:15 p.m.

CVE-2020-15692

2020-08-1419:15:12

Google

osv.dev

7.2 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.7%

JSON

In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system commands.

CPENameOperatorVersion
nimeq0.14.2
nimeq0.9.6
nimeq0.12.0
nimeq0.13.0
nimeq0.16.0
nimeq1.2.4
nimeq1.2.0
nimeq0.11.2
nimeq1.2.2
nimeq0.8.14

Name	Operator	Version
nim	eq	0.14.2
nim	eq	0.9.6
nim	eq	0.12.0
nim	eq	0.13.0
nim	eq	0.16.0
nim	eq	1.2.4
nim	eq	1.2.0
nim	eq	0.11.2
nim	eq	1.2.2
nim	eq	0.8.14

Rows per page:

1-10 of 251

References

www.openwall.com/lists/oss-security/2021/02/04/1

consensys.net/diligence/vulnerabilities/nim-browsers-argument-injection/

github.com/nim-lang/Nim/blob/dc5a40f3f39c6ea672e6dc6aca7f8118a69dda99/lib/pure/browsers.nim#L48

nim-lang.org/blog/2020/07/30/versions-126-and-108-released.html