CVE-2020-15692

CRITICAL 9.8CVE-2020-15692 · Published 14/08/2020 · updated 17/06/2026

In short

CVE-2020-15692 is a CRITICAL (CVSS 9.8) vulnerability affecting nim (nim-lang).
Chance of exploitation in the next 30 days (EPSS): 4.2%, higher than 91.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
nim nim-lang	`≤ 1.2.6`	No fix yet

Description

In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system commands.

References

openwall.com/lists/oss-security/2021/02/04/1 · Exploit
consensys.net/diligence/vulnerabilities/nim-browsers-argument-injection · Exploit
nim-lang/Nim · Patch
nim-lang.org/blog/2020/07/30/versions-126-and-108-released.html · Release Notes

More vulnerabilities in nim

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

nim

nim-lang

≤ 1.2.6

No fix yet

Description

More vulnerabilities in nim

See all →