{"action":"Upgrade thenify to 3.3.1 or later.","affected":[{"fixed":"3.3.1","introduced":"0"}],"component":"thenify","cve_ids":["CVE-2020-7677"],"ecosystem":"npm","epss":0.02082,"exploited":false,"fixed_versions":["3.3.1"],"ghsa_id":"GHSA-29xr-v42j-r956","id":"tcs_01M5KESQAEF74DKQ9DJFDS0D6D","modified_at":"2026-05-05T15:58:36.783815Z","published_at":"2022-07-18T19:15:29Z","references":["https://osv.dev/vulnerability/GHSA-29xr-v42j-r956","https://nvd.nist.gov/vuln/detail/CVE-2020-7677","https://github.com/thenables/thenify/issues/29","https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a","https://github.com/thenables/thenify","https://github.com/thenables/thenify/blob/master/index.js%23L17","https://lists.debian.org/debian-lts-announce/2022/09/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317","https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-29xr-v42j-r956","url":"https://osv.dev/vulnerability/GHSA-29xr-v42j-r956"}],"summary":"thenify before 3.3.1 made use of unsafe calls to `eval`."}