Every CVE Search/ Get API key

CVE-2020-7677

Arbitrary Code Execution

8.6 HighFix available

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
Low

Exploit likelihood

2.08%Up 1.1 points since Jul 26, 2022
90%50%10%1%

What each source reports

CVE List Score used 8.6

Arbitrary Code Execution

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

Record
CVE-2020-7677
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:U/RC:C
Updated
2026-11-02
EUVDEUVD-2022-6206 8.6

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

Record
EUVD-2022-6206
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:U/RC:C
Updated
2026-11-03
GitHub AdvisoriesGHSA-29xr-v42j-r956 9.8

thenify before 3.3.1 made use of unsafe calls to `eval`.

Versions of thenify prior to 3.3.1 made use of unsafe calls to eval. Untrusted user input could thus lead to arbitrary code execution on the host. The patch in version 3.3.1 removes calls to eval.

Record
GHSA-29xr-v42j-r956
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
NVD 8.6

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

Record
CVE-2020-7677
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

Record
CVE-2020-7677
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-7677 9.8

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

Record
DEBIAN-CVE-2020-7677
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-29xr-v42j-r956 9.8

thenify before 3.3.1 made use of unsafe calls to `eval`.

Versions of thenify prior to 3.3.1 made use of unsafe calls to eval. Untrusted user input could thus lead to arbitrary code execution on the host. The patch in version 3.3.1 removes calls to eval.

Record
GHSA-29xr-v42j-r956
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSVUBUNTU-CVE-2020-7677 9.8

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

Record
UBUNTU-CVE-2020-7677
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
OSVMGASA-2025-0194 No score

Updated yarnpkg packages fix security vulnerabilities

CVE-2024-37890 yarnpkg: denial of service when handling a request with many HTTP headers. CVE-2024-48949 yarnpkg: Missing Validation in Elliptic's EDDSA Signature Verification. CVE-2024-12905 yarnpkg: link following and path traversal via maliciously crafted tar file And other vulnerabilities in the yarn's bundled nodejs components are fixed too, see the references.

Record
MGASA-2025-0194
Updated
2026-11-02
OSVUSN-6016-1 No score

node-thenify vulnerability

It was discovered that thenify incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code.

Record
USN-6016-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
thenify
npm
 before 3.3.1
3.3.1
org.webjars.npm:thenify
Maven
 before 3.3.1
3.3.1
node-thenify
Debian:12
 before 3.3.1-1
3.3.1-1
node-thenify
Debian:13
 before 3.3.1-1
3.3.1-1
node-thenify
Debian:14
 before 3.3.1-1
3.3.1-1
node-thenify
Debian:10
 before 3.3.0-1+deb10u1, plus listed versions
3.3.0-1
3.3.0-1+deb10u1
org.webjars.npm:thenify
Maven
 before 3.3.1, plus listed versions
3.1.03.3.0
3.3.1
yarnpkg
Mageia:9
From an advisory covering 11 CVEs
 before 1.22.22-0.10.9.2.1.mga9
1.22.22-0.10.9.2.1.mga9
node-thenify
Ubuntu:18.04:LTS
 before 3.3.0-1+deb10u1build0.18.04.1, plus listed versions
3.3.0-1
3.3.0-1+deb10u1build0.18.04.1
node-thenify
Ubuntu:20.04:LTS
 before 3.3.0-1+deb10u1build0.20.04.1, plus listed versions
3.3.0-1
3.3.0-1+deb10u1build0.20.04.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-7677 is a high vulnerability (CVSS 8.6) in Thenify Project Thenify, published July 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.08%, the 81st percentile. Fixed in thenify 3.3.1.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open