PT-2022-9060 · Thenify+3 · Thenify+3

Published 2022-07-18 · Updated 2025-06-25 · CVE-2020-7677

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions thenify versions prior to 3.3.1

Description The issue arises from the lack of sanitization of the name argument provided to the thenify package, which is then passed to the eval function without any sanitization. This allows untrusted user input to lead to arbitrary code execution on the host. The eval function is used to execute JavaScript code, and passing unsanitized user input to it can lead to code injection attacks.

Recommendations For versions prior to 3.3.1, update to version 3.3.1 or later, which removes the unsafe calls to eval. As a temporary workaround, consider restricting user input to prevent arbitrary code execution until the patch is applied.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-7677

DLA-3128-1

GHSA-29XR-V42J-R956

MGASA-2025-0194

USN-6016-1

Affected Products

Astra Linux

Linuxmint

Ubuntu

Thenify

References · 28

• 🔥 https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317 · Exploit
• https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a · Patch
• https://ubuntu.com/security/notices/USN-6016-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VEDIJM7VQF4Q2L2KKQ6KJ2WZNR7AXYQD · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7677 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-7677 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3128-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0194 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2UGLXZO6VIHGIITQTEUY5Q5YCAP2A4ZP · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-7677 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0194.html · Security Note