PRIOn Logo

CVE-2024-36400 Code injection

Remediate Within one Month

CVE Information

Original CVE data


nano-id is a unique string ID generator for Rust. Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the `nano_id::base62` and `nano_id::base58` functions. Specifically, the `base62` function used a character set of 32 symbols instead of the intended 62 symbols, and the `base58` function used a character set of 16 symbols instead of the intended 58 symbols. Additionally, the `nano_id::gen` macro is also affected when a custom character set that is not a power of 2 in size is specified. It should be noted that `nano_id::base64` is not affected by this vulnerability. This can result in a significant reduction in entropy, making the generated IDs predictable and vulnerable to brute-force attacks when the IDs are used in security-sensitive contexts such as session tokens or unique identifiers. The vulnerability is fixed in 0.4.0.

CWE: CWE-331
CVSS v2-
CVSS v39.8
Affected Vendors

Viz - (1)

Basic Analysis

Common vulnerability metrics

Vulnerabilty type as detected by PRIOnengine

Code injection

CVSS Scores as calculated by PRIOnengine
CVSS v24.3
CVSS v39.1



No exploit code is reported to exist.

Active Exploitation

Vulnerability is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. See the KEV Catalog

Social Network Activity


Threat Actor Activity

No sightings of the vulnerability within threat reports.

Cybersecurity Frameworks

How the vulnerability maps against various cybersecurity frameworks

T1499.004 - Endpoint Denial of Service (Application or System Exploitation)
T1110 - Brute Force
T1087 - Account Discovery
T1021 - Remote Services

Compliance Impact

How the submited vulnerability affects compliance

PCI DSS v3.2.1-6.5.3 - Insecure Cryptographic Storage

Web Application Security Frameworks

Applicable if the issue likely affects a web application