CVE-2020-15693

Name of the Vulnerable Software and Affected Versions Nim version 1.2.4

Description The standard library httpClient in Nim is susceptible to a CR-LF injection in the target URL. This injection can occur if an attacker controls any part of the URL provided in a call, such as httpClient.get or httpClient.post, the User-Agent header value, or custom HTTP header names or values.

Recommendations For Nim version 1.2.4, consider restricting the use of the httpClient module until a patch is available, and avoid using user-controlled input in the URL, User-Agent header, or custom HTTP headers to minimize the risk of exploitation.