What’s Vulnerable › Vulnerabilities

CVE-2021-21372: Nimble arbitrary code execution for specially crafted package metadata

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-03-26 · updated 2026-06-17
• Weakness: CWE-20

Description

Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.

Affected products

• nim-lang Nim: before 1.2.10; from 1.4.0 before 1.4.4 — fixed in 1.2.10, 1.4.4

How to fix

Upgrade to a fixed version: nim-lang Nim 1.2.10, 1.4.4. Check the vendor advisory for mitigations.

References

• https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/
• https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130
• https://github.com/nim-lang/nimble/commit/7bd63d504a4157b8ed61a51af47fb086ee818c37
• https://github.com/nim-lang/security/security/advisories/GHSA-rg9f-w24h-962p
• https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/
• https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130
• https://github.com/nim-lang/nimble/commit/7bd63d504a4157b8ed61a51af47fb086ee818c37
• https://github.com/nim-lang/security/security/advisories/GHSA-rg9f-w24h-962p

Get alerted when CVE-2021-21372 or the next vulnerability affects your stack