{"id":"CVE-2021-46872","aliases":["DEBIAN-CVE-2021-46872","EUVD-2021-33525","GHSA-6fm4-9v93-v7gg","UBUNTU-CVE-2021-46872"],"status":"published","title":"An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used...","description":"An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00562,"percentile":0.47202,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-01-13T00:00:00Z","modified":"2026-10-24T10:50:43Z","fixes":[{"ecosystem":"Debian:12","package":"nim","fixed_in":["1.6.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nim","fixed_in":["1.6.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1"}]}],"versions":["0.11.2+dfsg1-1","0.11.2+dfsg1-2","0.11.2+dfsg1-3","0.11.2+dfsg1-4","0.12.0-1","0.12.0-2","0.13.0-1","0.14.2-1","0.15.0-1","0.15.0-2","0.15.0-3","0.15.2-1","0.15.2-2","0.16.0-1","0.17.0-1","0.17.0-2","0.17.0-2~bpo9+1","0.17.2-1","0.18.0-1","0.18.0-2","0.19.0-1","0.19.2-1","0.19.2-2","0.19.4-1","0.19.6-1","0.19.6-2","0.20.0-1","0.20.0-2","0.20.2-1","1.0.0-1","1.0.0-1~bpo10+1","1.0.2-1","1.0.2-1~bpo10+1","1.0.2~a-1","1.0.2~b-1","1.0.2~rc-1","1.0.3~rc-1","1.0.4-1","1.0.4-1~bpo10+1","1.0.5~rc-1","1.0.6-1","1.2.0-1","1.2.0~rc-1","1.2.0~rc2-1","1.2.0~rc3-1","1.2.1~rc1-1","1.2.1~rc2-1","1.2.2-1","1.2.4-1","1.2.6-1","1.2.6~rc1-1","1.4.0-1","1.4.2-1","1.4.6+really1.4.2-1","1.4.6+really1.4.2-2","1.4.6-1","1.4.8-1","1.4.8-2","1.4.8-3","1.6.0-1","1.6.0-1.1","1.6.2-1~bpo11+1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.2+dfsg1-4","0.12.0-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.2-1ubuntu1","0.17.2-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20.2-1","1.0.2-1","1.0.3~rc-1","1.0.4-1","1.0.6-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.14-1","1.6.14-1ubuntu1","1.6.14-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.14-1ubuntu2","2.2.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.4-2","2.2.10-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.4-1","2.2.4-2"]}],"products":[{"vendor":"nim-lang","product":"nim"},{"vendor":"nim-lang","product":"nimforum"}],"references":[{"url":"https://github.com/nim-lang/nimforum","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://forum.nim-lang.org/t/8852","tags":["x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://github.com/nim-lang/Nim/pull/19134","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/nim-lang/Nim/compare/v1.6.0...v1.6.2","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://github.com/nim-lang/Nim/commit/46275126b89218e64844eee169e8ced05dd0e2d7","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46872"},{"url":"https://github.com/advisories/GHSA-6fm4-9v93-v7gg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-46872","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-46872","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-46872","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-46872","description":"An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)","status":"published","published":"2023-01-13T00:00:00Z","modified":"2025-04-07T19:13:15.282Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:02.930115Z"}],"euvd":[{"id":"EUVD-2021-33525","description":"An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)","status":"published","published":"2023-01-13T00:00:00Z","modified":"2025-04-07T19:13:15Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:40.600826Z"}],"ghsa":[{"id":"GHSA-6fm4-9v93-v7gg","title":"An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used...","description":"An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)","status":"published","published":"2023-01-13T06:30:22Z","modified":"2023-01-23T21:30:25Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:41:42.013329Z"}],"nvd":[{"id":"CVE-2021-46872","description":"An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)","status":"published","published":"2023-01-13T06:15:10.94Z","modified":"2026-06-17T04:15:41.963Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:07.323379Z"}],"osv":[{"id":"CVE-2021-46872","description":"An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)","status":"published","published":"2023-01-13T06:15:10.94Z","modified":"2026-10-24T10:50:43.838318702Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:22.18434Z"},{"id":"DEBIAN-CVE-2021-46872","description":"An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)","status":"published","published":"2023-01-13T06:15:10.94Z","modified":"2026-10-23T18:04:01.418913728Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"UBUNTU-CVE-2021-46872","description":"An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)","status":"published","published":"2023-01-13T06:15:00Z","modified":"2026-10-17T12:56:16.244034562Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:30.277322Z"}]}}