Skip to content
Fencer Vulns
high 8.6

CVE-2020-7677 json

Arbitrary Code Execution

published 2022-07-18 4 y ago modified 2026-06-17 4 mo ago also GHSA-29xr-v42j-r956 , EUVD-2022-6206

cvss
8.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

Patch / fix

  • npm thenify 3.3.1
  • maven org.webjars.npm:thenify 3.3.1
  • n/a thenify 3.3.1
  • node-thenify Debian 14, Debian 13, Debian 12 3.3.1-1

debian advisories DEBIAN-CVE-2020-7677

  • node-thenify Ubuntu 18.04 LTS 3.3.0-1+deb10u1build0.18.04.1
  • node-thenify Ubuntu 20.04 LTS 3.3.0-1+deb10u1build0.20.04.1

ubuntu advisories UBUNTU-CVE-2020-7677

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-7677 updated cvss 9.8

thenify: Arbitrary Code Execution in thenify

  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8 Red Hat build of Apicurio Registry 2 thenify
    affected: no fix available
  • Red Hat Integration Service Registry thenify
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console
    affected: no fix available
  • Red Hat Integration Camel K 1 thenify
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.08% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • security.snyk.io https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690 referenced PoC, tagged "exploit" by a source, unverified
  • security.snyk.io https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:U/RC:C
CNA 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm thenify
<3.3.1
3.3.1
maven org.webjars.npm:thenify
<3.3.1
3.3.1

Affected products

  • n/a thenify

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.