CriticalFix available
node-thenify — security advisory
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.
- Products
- node-thenify
- Affected versions
- Not specified
- Fixed versions
- 3.3.1-1
- CVEs
- CVE-2020-7677
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 13:16 UTC · Revision 1
Source evidence
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.
osv:DEBIAN-CVE-2020-7677
node-thenify
Fixed versions: 3.3.1-1
node-thenify
Fixed versions: 3.3.1-1
node-thenify
Fixed versions: 3.3.1-1
Complete source record
{
"id": "04c7b9d1330ed2281a18d0700e4011355a945fa6107416f3c401de7baf619f58",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2020-7677",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2020-7677",
"summary": "This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.",
"evidence": "osv:DEBIAN-CVE-2020-7677",
"products": [
{
"name": {
"value": "node-thenify",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.3.1-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "node-thenify",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.3.1-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "node-thenify",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.3.1-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "DEBIAN-CVE-2020-7677",
"aliases": [
"DEBIAN-CVE-2020-7677"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.1-1"
}
]
}
],
"package": {
"name": "node-thenify",
"purl": "pkg:deb/debian/node-thenify?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-7677.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.1-1"
}
]
}
],
"package": {
"name": "node-thenify",
"purl": "pkg:deb/debian/node-thenify?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-7677.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.1-1"
}
]
}
],
"package": {
"name": "node-thenify",
"purl": "pkg:deb/debian/node-thenify?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-7677.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T12:02:15.666602774Z",
"provider": "osv",
"upstream": [
"CVE-2020-7677"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2020-7677"
]
},
"related_cves": [
{
"value": "CVE-2020-7677",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 452064,
"published_at": "2022-07-25T14:15:10.047+00:00"
}