Description
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.
Remediation
References
https://github.com/thenables/thenify/blob/master/index.js%23L17
https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a
https://lists.debian.org/debian-lts-announce/2022/09/msg00039.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317
https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690
Related Vulnerabilities
CVE-2020-7774 Vulnerability in maven package org.webjars.npm:y18n
CVE-2021-39232 Vulnerability in maven package org.apache.ozone:ozone-main
CVE-2022-25940 Vulnerability in maven package org.webjars.npm:lite-server
CVE-2019-14862 Vulnerability in maven package li.rudin.mavenjs:knockout
CVE-2023-26048 Vulnerability in maven package org.eclipse.jetty:jetty-server