CVE-2020-7784

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js. The vulnerability is demonstrated with the following PoC:

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jan 8, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-77859.8This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js.CVE-2020-77869.8This affects all versions of package macfromip. The injection point is located in line 66 in macfromip.js.CVE-2020-77878.2This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, sessiCVE-2020-77889.8This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, theyCVE-2020-77895.6This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options paCVE-2020-77905.3This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitraryCVE-2020-77917.5This affects the package i18n before 2.1.15. Vulnerability arises out of insufficient handling of erroneous language tags in src/i18n/ConcreCVE-2020-77927.5This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixInCVE-2020-77937.5The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commitCVE-2020-77949.8This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function inCVE-2020-77959.8The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js.CVE-2020-77969.8Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.