All the vulnerabilities related to the version 1.0.0 of the package
thenify before 3.3.1 made use of unsafe calls to eval
.
Versions of thenify prior to 3.3.1 made use of unsafe calls to eval
. Untrusted user input could thus lead to arbitrary code execution on the host. The patch in version 3.3.1 removes calls to eval
.