CVE-2020-15692 Command injection in n/a
Attackers can execute arbitrary system commands by passing malicious local file paths to the Nim standard library's browser opening function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15692?
CVE-2020-15692 is a critical command injection vulnerability in n/a, published on 14 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system commands.
Weakness: CWE-88
Which versions are affected by CVE-2020-15692?
It affects 1 product.
Products include Nim-Lang Nim.
How do I fix CVE-2020-15692?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-15692 being exploited?
There is no known exploitation of CVE-2020-15692 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-15690 Other in n/a
- CVE-2021-21372 Nimble arbitrary code execution for specially crafted package metadata
- CVE-2021-21374 Nimble fails to validate certificates due to insecure httpClient defaults
- CVE-2021-21373 Nimble falls back to insecure http url when fetching packages
- CVE-2020-15694 Other in n/a
Sources
Also known as DEBIAN-CVE-2020-15692, UBUNTU-CVE-2020-15692.