85 matches found
GHSA-5Q88-CJFQ-G2MH codecov NPM module allows remote attackers to execute arbitrary commands
codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596...
PT-2020-14203
Name of the Vulnerable Software and Affected Versions codecov versions prior to 3.7.1 codecov-node versions prior to 3.6.5 Description The issue is related to a command injection vulnerability in the upload method of the codecov package. This vulnerability can be exploited using backticks to bypa...
Remote Code Execution (RCE)
codecov is vulnerable to remote code execution RCE. Due to an incomplete fix of CVE-2020-7596, the gcov-root and ather parameters are not sanitized properly and being executed in the exe function of lib/codecov.js, allowing an attacker to trigger RCE...
Codecov-node npm module command execution vulnerability
The codecov-node npm module is an application global coverage module. A security vulnerability exists in codecov-node npm module versions prior to 3.6.5. A remote attacker can exploit the vulnerability to execute arbitrary commands...
CVE-2020-7597
codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596...
CVE-2020-7597
codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596...
CVE-2020-7597
codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596...
CVE-2020-7597
codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596...
CVE-2020-7597
CVE-2020-7597 (codecov-node) affects the npm package codecov-node before 3.6.5. The issue allows remote attackers to execute arbitrary commands because the value passed as part of the gcov-root argument is executed by the exec function in lib/codecov.js. Root cause is an incomplete fix of CVE-202...
CVE-2020-7597
codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596...
PT-2020-19645
Name of the Vulnerable Software and Affected Versions codecov-node versions prior to 3.6.5 Description The issue allows remote attackers to execute arbitrary commands due to an incomplete fix of a previous problem. The value provided as part of the gcov-root argument is executed by the exec...
CVE-2020-7597: Improper Neutralization of Special Elements used in an OS Command
codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596...
@aliyun-sls/sql (>=0.2.9-dev-10, <=0.3.10-dev-9), @dpjayasekara/tscore (>=0.0.1, <=0.1.1) +29 more potentially affected by CVE-2020-7596 +1 more via codecov (>=3.0.0, <=3.6.1)
codecov NPM version =3.0.0, =0.2.9-dev-10, =0.0.1, =0.0.29, =1.0.10, =1.0.18, =1.0.0, =1.7.0, =1.0.1, =1.0.8, =0.1.1, =0.1.6, =0.1.1, =0.0.1, =1.17.0, =1.22.16 and more Source cves: CVE-2020-7596, CVE-2020-7597 Source advisory: SNYK:JS-CODECOV-548879...
Command Injection
Overview codecov is a npm package for uploading reports to Codecov. Affected versions of this package are vulnerable to Command Injection. The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fi...
CVE-2020-7596
Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument...
CVE-2020-7596
Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument...
CVE-2020-7596
Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument...
Command injection
Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument...
CVE-2020-7596
CVE-2020-7596 affects the codecov-node npm module and its code path that processes the gcov-args/gcov-root argument. Multiple connected sources confirm that codecov-node prior to 3.6.5 (and originally up to 3.6.2 for the core CVE-2020-7596 fix) allows remote attackers to execute arbitrary command...