CVE-2020-7677

Source

https://nvd.nist.gov/vuln/detail/CVE-2020-7677

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7677.json

Aliases

• GHSA-29xr-v42j-r956

Related

• DLA-3128-1
• USN-6016-1

Published

2022-07-25T14:15:10Z

Modified

2023-11-29T08:35:37.923594Z

Details

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

References

• https://lists.debian.org/debian-lts-announce/2022/09/msg00039.html
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317
• https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690
• https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a
• https://github.com/thenables/thenify/blob/master/index.js%23L17
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/