CVE-2020-7677

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Jul 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-76789.8This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitizatiCVE-2020-76799.8In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution.CVE-2020-76806.1docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to loadCVE-2020-76817.5This affects all versions of package marscode. There is no path sanitization in the path provided at fs.readFile in index.js.CVE-2020-76827.5This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js.CVE-2020-76837.5This affects all versions of package rollup-plugin-server. There is no path sanitization in readFile operation performed inside the readFileCVE-2020-76849.8This affects all versions of package rollup-plugin-serve. There is no path sanitization in readFile operation.CVE-2020-76857.5This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitraryCVE-2020-76867.5This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromCoCVE-2020-76877.5This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js.CVE-2020-76887.8The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.CVE-2020-76897.5Data is truncated wrong when its length is greater than 255 bytes.
CVE-2020-7677: Critical severity, CVSS 9.8 | Vulnix