Description
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.
Remediation
References
https://github.com/thenables/thenify/blob/master/index.js%23L17
https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a
https://lists.debian.org/debian-lts-announce/2022/09/msg00039.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317
https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690
Related Vulnerabilities
CVE-2022-24822 Vulnerability in npm package @podium/proxy
CVE-2023-6460 Vulnerability in npm package @google-cloud/firestore
CVE-2021-41193 Vulnerability in maven package com.wire:avs
CVE-2019-13000 Vulnerability in maven package fr.acinq.eclair:eclair-core_2.11
CVE-2023-32695 Vulnerability in maven package org.webjars.npm:socket.io-parser