CVE-2020-7677: thenify before 3.3.1 made use of unsafe calls to `eval`.
9.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.39186%
CWE
Published
7/18/2022
Updated
1/23/2023
KEV Status
No
Technology
JavaScript
JavaScriptTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| thenify | npm | < 3.3.1 | 3.3.1 |
| org.webjars.npm:thenify | maven | < 3.3.1 | 3.3.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stemmed from unsafe eval() usage in both the thenify function and its withCallback method. The pre-patch code constructed a function string in createWrapper and executed it via eval(), using the original function's name ($$fn$$.name) without sanitization. Since attackers could manipulate the function name (e.g., via Object.defineProperty), this allowed arbitrary code injection. The commit 0d94a24 removed eval() entirely, replacing it with direct function construction, confirming these were the vulnerable entry points.