CVE-2020-7596 - Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument

HIGH

Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument

Published Jan 25, 2020

8.8

HIGH

CVSS 3.1

EPSS 1.86%

Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Codecov Npm Module

n/a

Version	Status	Constraints
All versions prior to version 3.6.2	affected	-

Ecosystem	Package	Introduced	Fixed
npm	codecov	0	3.6.2

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-78

OS Command Injection

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4566		Advisory
https://github.com/advisories/GHSA-mh2h-6j8q-x246		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7596
https://snyk.io/vuln/SNYK-JS-CODECOV-543183		x_refsource_MISCExploitPatchThird Party Advisory