CVE-2021-21373: Nim-Lang Nim

Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days.

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.

Affected products

• Nim-Lang Nim: before 1.2.10 (fixed in 1.2.10); from 1.4.0, before 1.4.4 (fixed in 1.4.4)

Published 2021-03-26. Last modified 2026-06-17.