Description
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a thenify
unspecified to < 3.3.1affected
References
- https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690 ↗
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317 ↗
- https://github.com/thenables/thenify/blob/master/index.js%23L17 ↗
- https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a ↗
- https://lists.debian.org/debian-lts-announce/2022/09/msg00039.html ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/ ↗