-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| thenify | npm | < 3.3.1 | 3.3.1 |
| org.webjars.npm:thenify | maven | < 3.3.1 | 3.3.1 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stemmed from unsafe eval() usage in both the thenify function and its withCallback method. The pre-patch code constructed a function string in createWrapper and executed it via eval(), using the original function's name ($$fn$$.name) without sanitization. Since attackers could manipulate the function name (e.g., via Object.defineProperty), this allowed arbitrary code injection. The commit 0d94a24 removed eval() entirely, replacing it with direct function construction, confirming these were the vulnerable entry points.