CVE-2020-7677

Arbitrary Code Execution

High · published July 25, 2022

CVSS v3.1
8.6
EPSS
2%
Percentile
81.4
In the wild
Unconfirmed
What it is

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:U/RC:C
CVSS v4.0
Not supplied
EPSS
0.02082 · 81.4th percentile
Published
2022-07-25T14:08Z
EPSS history
Timeline
  • 25 JUL 14:08Z
    Arbitrary Code Execution
    cvelistv5