Arbitrary code execution in thenify
Priority MEDIUM 46CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.
Summary
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.
Why it matters now
EPSS 0.02082 81st percentileScored 2026-11-07
Fix Partial thenify: 3.3.1thenify (npm): 3.3.1+1 more productRed Hat: 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | thenify | before 3.3.1 | 3.3.1 | Patch available | CNA |
| — | thenify (npm) | before 3.3.1 | 3.3.1 | Patch available | GHSA-29xr-v42j-r956 |
| — | org.webjars.npm:thenify (Maven) | before 3.3.1 | 3.3.1 | Patch available | GHSA-29xr-v42j-r956 |
- thenify Vendor— Affected before 3.3.1 Fixed in 3.3.1 Patch available CNA
- thenify (npm) Vendor— Affected before 3.3.1 Fixed in 3.3.1 Patch available GHSA-29xr-v42j-r956
- org.webjars.npm:thenify (Maven) Vendor— Affected before 3.3.1 Fixed in 3.3.1 Patch available GHSA-29xr-v42j-r956
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:thenify_project:thenify:*:*:*:*:*:node.js:*:* | before 3.3.1 | Vulnerable | Thenify Project |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
- cpe:2.3:a:thenify_project:thenify:*:*:*:*:*:node.js:*:* Versions before 3.3.1 Vulnerable ·Thenify Project
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA thenify Fixed in 3.3.1
- Fix · GHSA-29xr-v42j-r956 thenify (npm) Fixed in 3.3.1 Advisory →
- Fix · GHSA-29xr-v42j-r956 org.webjars.npm:thenify (Maven) Fixed in 3.3.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 2 | Affected | No fix yet |
| Red Hat Integration Service Registry | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
Not affected: 1 product
- Red Hat Integration Camel K 1
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7677
- 2026-10-03 Alias added: GHSA-29xr-v42j-r956
References
Advisory 4
Other 5
- https://github.com/thenables/thenify/blob/master/index.js%23L17
- https://github.com/thenables/thenify/issues/29
- https://github.com/thenables/thenify
- https://lists.fedoraproject.org/archives/list/[email protected]/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3
- https://lists.fedoraproject.org/archives/list/[email protected]/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK
Sources
- CVE-2020-7677 · CVE Program
- CVE-2020-7677 · NVD
- FIRST EPSS
- GHSA-29xr-v42j-r956 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-7677 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences