CVE-2020-15692

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system commands.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-88

Affected software

No affected versions have been published.

Timeline

Published: Aug 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-156936.5In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker CVE-2020-156947.5In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get().contentLength() CVE-2020-156956.3An issue was discovered in Joomla! through 3.9.19. A missing token check in the remove request section of com_privacy causes a CSRF vulnerab CVE-2020-156966.1An issue was discovered in Joomla! through 3.9.19. Lack of input filtering and escaping allows XSS attacks in mod_random_image.CVE-2020-156974.3An issue was discovered in Joomla! through 3.9.19. Internal read-only fields in the User table class could be modified by users.CVE-2020-156985.3An issue was discovered in Joomla! through 3.9.19. Inadequate filtering on the system information screen could expose Redis or proxy credent CVE-2020-156995.3An issue was discovered in Joomla! through 3.9.19. Missing validation checks on the usergroups table object can result in a broken site conf CVE-2020-15707.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulner CVE-2020-157006.3An issue was discovered in Joomla! through 3.9.19. A missing token check in the ajax_install endpoint of com_installer causes a CSRF vulnera CVE-2020-157015.5An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtim CVE-2020-157027.0TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exi CVE-2020-157033.3There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directo