CVE-2020-15692

Name of the Vulnerable Software and Affected Versions Nim version 1.2.4

Description The standard library browsers in Nim mishandle the URL argument to browsers.openDefaultBrowser(), allowing an attacker to pass an argument to the underlying open command and execute arbitrary registered system commands. This can occur when the URL argument is a local file path that will be opened in the default explorer.

Recommendations For Nim version 1.2.4, consider disabling the browsers.openDefaultBrowser() function until a patch is available to prevent exploitation. Restrict access to the browsers module to minimize the risk of arbitrary command execution. Avoid using the openDefaultBrowser function with untrusted input until the issue is resolved.