thenify before 3.3.1 made use of unsafe calls to `eval`.

CRITICAL 9.8CVE-2020-7677 · GHSA-29xr-v42j-r956 · Published 25/07/2022 · updated 17/06/2026

In short

CVE-2020-7677 is a CRITICAL (CVSS 9.8) vulnerability affecting org.webjars.npm:thenify, thenify (thenify project), thenify.
Chance of exploitation in the next 30 days (EPSS): 2.1%, higher than 81.7% of all vulnerabilities.
Fix: update to 3.3.1 or later.

Package	Affected versions	Patched versions
org.webjars.npm:thenify Maven	`< 3.3.1`	`3.3.1`
thenify thenify_project	`< 3.3.1`	`3.3.1`
thenify npm	`< 3.3.1`	`3.3.1`

Description

Versions of thenify prior to 3.3.1 made use of unsafe calls to eval. Untrusted user input could thus lead to arbitrary code execution on the host. The patch in version 3.3.1 removes calls to eval.

NVD description

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

References

nvd.nist.gov/vuln/detail/CVE-2020-7677 · ADVISORY
thenables/thenify · WEB
thenables/thenify commit 0d94a24 · WEB
thenables/thenify · PACKAGE
thenables/thenify · WEB
lists.debian.org/debian-lts-announce/2022/09/msg00039.html · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3 · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK · WEB
security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317 · WEB
security.snyk.io/vuln/SNYK-JS-THENIFY-571690 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free