All the vulnerabilities related to the version 3.2.1 of the package
thenify before 3.3.1 made use of unsafe calls to eval
.
Versions of thenify prior to 3.3.1 made use of unsafe calls to eval
. Untrusted user input could thus lead to arbitrary code execution on the host. The patch in version 3.3.1 removes calls to eval
.