CVE-2021-46872 Cross-site scripting in n/a
The Nim language stdlib RST module allows javascript URIs, enabling cross-site scripting attacks in applications using it.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-46872?
CVE-2021-46872 is a medium-severity cross-site scripting vulnerability in n/a, published on 13 Jan 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)
Weakness: CWE-79
Which versions are affected by CVE-2021-46872?
It affects 2 products.
Products include Nim-Lang Nim, Nim-Lang Nimforum.
How do I fix CVE-2021-46872?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-46872 being exploited?
There is no known exploitation of CVE-2021-46872 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-15690 Other in n/a
- CVE-2020-15692 Command injection in n/a
- CVE-2021-21372 Nimble arbitrary code execution for specially crafted package metadata
- CVE-2021-21374 Nimble fails to validate certificates due to insecure httpClient defaults
- CVE-2021-21373 Nimble falls back to insecure http url when fetching packages
Sources
Also known as DEBIAN-CVE-2021-46872, GHSA-6fm4-9v93-v7gg, UBUNTU-CVE-2021-46872.