Skip to content
OpenAdvisories
High · 8.8 CVE-2020-7596 EUVD-2022-4566GHSA-mh2h-6j8q-x246

Improper Neutralization of Special Elements in Output Used by a Downstream Component in Codecov

Published Jan 25, 2020 · Updated Aug 4, 2024 · Assigned by snyk

Package: codecov Ecosystem: npm

Description

Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument.

Affected products

VendorProductAffectedFixed
— codecov npm module All versions prior to version 3.6.2 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm codecov < 3.6.2 3.6.2 GHSA-mh2h-6j8q-x246

References