CVE-2021-21374: Nim-Lang Nim

High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days.

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.

Affected products

• Nim-Lang Nim: before 1.2.10 (fixed in 1.2.10); from 1.4.0, before 1.4.4 (fixed in 1.4.4)

Published 2021-03-26. Last modified 2026-06-17.