CVE-2020-23171

Name of the Vulnerable Software and Affected Versions Nim-lang versions all

Description A vulnerability allows unauthenticated attackers to write files to arbitrary directories via a crafted zip file with dot-slash characters included in the name of the crafted file.

Recommendations For Nim-lang versions all, consider restricting the handling of zip files with dot-slash characters in file names to prevent arbitrary file writing until a patch is available. As a temporary workaround, consider validating and sanitizing zip file contents before processing them.