~ / search / GHSA-29xr-v42j-r956

GHSA-29xr-v42j-r956

thenify before 3.3.1 made use of unsafe calls to `eval`.

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-7677

Packages

EcosystemPackageAffectedFixed in
npm thenify < 3.3.1 3.3.1
Maven org.webjars.npm:thenify < 3.3.1 3.3.1

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of thenify prior to 3.3.1 made use of unsafe calls to `eval`. Untrusted user input could thus lead to arbitrary code execution on the host. The patch in version 3.3.1 removes calls to `eval`.

References

External links from the advisory. They lead to third-party sites.