Skip to content

[SG-39076] thenify before 3.3.1 made use of unsafe calls to eval.

Warren Gifford requested to merge contractors/SG-39076 into main

Created by: gitstart-sourcegraph

Description

Versions of thenify prior to 3.3.1 made use of unsafe calls to eval. Untrusted user input could thus lead to arbitrary code execution on the host. The patch in version 3.3.1 removes calls to eval.

Success criteria

Update thenify to a non-vulnerable version

Implementation details

The latest possible version of thenify that can be installed is 3.3.0. The earliest fixed version is 3.3.1.

  • Affected versions < 3.3.1

Refs

Sourcegraph issue Gitstart ticket

Test plan

Make sure there is no CI error resulting from this change

App preview:

Check out the client app preview documentation to learn more.

Merge request reports