CVE-2020-7677

Published: Jul 25, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

Affected (4)

Products: Thenify Project: Thenify · Debian: Debian Linux · Fedoraproject: Fedora

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Thenify Project Thenify	Before 3.3.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 36
Fedoraproject Fedora	Version 37

References (14)

https://github.com/thenables/thenify/blob/master/index.js%23L17

Source: report@snyk.io

Broken Link

https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a

Source: report@snyk.io

Patch

https://lists.debian.org/debian-lts-announce/2022/09/msg00039.html

Source: report@snyk.io

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/

Source: report@snyk.io

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/

Source: report@snyk.io

https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317

Source: report@snyk.io

ExploitThird Party Advisory

https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690

Source: report@snyk.io

ExploitThird Party Advisory

https://github.com/thenables/thenify/blob/master/index.js%23L17