CVE-2021-46872
An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used...
An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)
- Record
CVE-2021-46872- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List
An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)
- Record
CVE-2021-46872- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2021-33525
An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)
- Record
EUVD-2021-33525- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6fm4-9v93-v7gg
An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used...
An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)
- Record
GHSA-6fm4-9v93-v7gg- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)
- Record
CVE-2021-46872- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-46872
An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)
- Record
DEBIAN-CVE-2021-46872- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-46872
An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)
- Record
UBUNTU-CVE-2021-46872- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nimDebian:12 |
before 1.6.2-1 | 1.6.2-1 |
nimDebian:14 |
before 1.6.2-1, plus listed versions 0.11.2+dfsg1-10.11.2+dfsg1-20.11.2+dfsg1-30.11.2+dfsg1-40.12.0-1 Show 45 moreShow less0.12.0-20.13.0-10.14.2-10.15.0-10.15.0-20.15.0-30.15.2-10.15.2-20.16.0-10.17.0-10.17.0-20.17.0-2~bpo9+10.17.2-10.18.0-10.18.0-20.19.0-10.19.2-10.19.2-20.19.4-10.19.6-10.19.6-20.20.0-10.20.0-20.20.2-11.0.0-11.0.0-1~bpo10+11.0.2-11.0.2-1~bpo10+11.0.2~a-11.0.2~b-11.0.2~rc-11.0.3~rc-11.0.4-11.0.4-1~bpo10+11.0.5~rc-11.0.6-11.2.0-11.2.0~rc-11.2.0~rc2-11.2.0~rc3-11.2.1~rc1-11.2.1~rc2-11.2.2-11.2.4-11.2.6-1 |
1.6.2-1 |
nimUbuntu:16.04:LTS |
All versions, plus listed versions 0.11.2+dfsg1-40.12.0-2 |
None known |
nimUbuntu:18.04:LTS |
All versions, plus listed versions 0.17.2-1ubuntu10.17.2-1ubuntu2 |
None known |
nimUbuntu:20.04:LTS |
All versions, plus listed versions 0.20.2-11.0.2-11.0.3~rc-11.0.4-11.0.6-1 |
None known |
nimUbuntu:24.04:LTS |
All versions, plus listed versions 1.6.14-11.6.14-1ubuntu11.6.14-1ubuntu2 |
None known |
nimUbuntu:25.10 |
All versions, plus listed versions 1.6.14-1ubuntu22.2.4-1 |
None known |
nimUbuntu:26.10 |
All versions, plus listed versions 2.2.4-22.2.10-1 |
None known |
nimUbuntu:26.04:LTS |
All versions, plus listed versions 2.2.4-12.2.4-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-46872 is a medium vulnerability (CVSS 6.1) in Nim-lang Nim, published January 13, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. Fixed in nim 1.6.2-1.
References
Left out here: 12 versions. The JSON record has them.