critical
CVE-2020-15692
In Nim 1.2.4, the standard library browsers mishandles the URL argumen ...
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Ubuntu (medium).
Description
In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system commands.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| debian 10 | nim | no fix listed |
| debian 11 | nim | 1.2.6-1 |
| debian 12 | nim | 1.2.6-1 |
| debian 14 | nim | 1.2.6-1 |
| debian 9 | nim | no fix listed |
| echo | nim | 1.2.6-1 |
| ubuntu 18.04-ESM | nim | no fix listed |
| ubuntu 20.04-ESM | nim | no fix listed |
| ubuntu 20.10 | nim | 1.2.6-1 |
| ubuntu 21.04 | nim | 1.2.6-1 |
| ubuntu 21.10 | nim | 1.2.6-1 |
| ubuntu 23.04 | nim | 1.2.6-1 |
Show all 19 entries from 19 sources
| Source | Package | Fixed in |
|---|---|---|
| debian 10 | nim | no fix listed |
| debian 11 | nim | 1.2.6-1 |
| debian 12 | nim | 1.2.6-1 |
| debian 14 | nim | 1.2.6-1 |
| debian 9 | nim | no fix listed |
| echo | nim | 1.2.6-1 |
| ubuntu 18.04-ESM | nim | no fix listed |
| ubuntu 20.04-ESM | nim | no fix listed |
| ubuntu 20.10 | nim | 1.2.6-1 |
| ubuntu 21.04 | nim | 1.2.6-1 |
| ubuntu 21.10 | nim | 1.2.6-1 |
| ubuntu 23.04 | nim | 1.2.6-1 |
| ubuntu 23.10 | nim | 1.2.6-1 |
| ubuntu 24.04 | nim | 1.2.6-1 |
| ubuntu 24.10 | nim | 1.2.6-1 |
| ubuntu 25.04 | nim | 1.2.6-1 |
| ubuntu 25.10 | nim | 1.2.6-1 |
| ubuntu 26.04 | nim | 1.2.6-1 |
| ubuntu 26.10 | nim | 1.2.6-1 |
References
- http://www.openwall.com/lists/oss-security/2021/02/04/1
- https://consensys.net/diligence/vulnerabilities/nim-browsers-argument-injection/
- https://github.com/nim-lang/Nim/blob/dc5a40f3f39c6ea672e6dc6aca7f8118a69dda99/lib/pure/browsers.nim#L48
- https://nim-lang.org/blog/2020/07/30/versions-126-and-108-released.html
- https://www.cve.org/CVERecord?id=CVE-2020-15692