Vulnerability · Published Jan 13, 2023 · Assigned by mitre
CVE-2021-46872
Medium 6.1
In plain English
A medium-severity cross-site scripting in the nim package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | nim | 1.6.2-1 | DEBIAN-CVE-2021-46872 |
| Debian:14 | nim | 1.6.2-1 | DEBIAN-CVE-2021-46872 |
| Ubuntu:24.04:LTS | nim | no fix listed | UBUNTU-CVE-2021-46872 |
| Ubuntu:25.10 | nim | no fix listed | UBUNTU-CVE-2021-46872 |
| Ubuntu:26.04:LTS | nim | no fix listed | UBUNTU-CVE-2021-46872 |
| Ubuntu:26.10 | nim | no fix listed | UBUNTU-CVE-2021-46872 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N