Command Injection

codecov is vulnerable to command injection. The vulnerability exists due to the lack of sanitization in the gcov arguments in the main function of init.py, allowing an attacker to inject and execute malicious commands before being provided to the Popen functionality...

Codecov does not sanitize gcov arguments

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method...

GHSA-H3QR-FJHM-JPHW Codecov does not sanitize gcov arguments

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method...

CVE-2019-10800

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method...

CVE-2019-10800

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method...

PYSEC-2022-238

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method...

PYSEC-2022-238

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method...

CVE-2019-10800

The CVE-2019-10800 issue affects the Python package codecov prior to 2.0.16, caused by inadequate sanitization of gcov arguments before passing them to subprocess popen. Impact is described in connected advisories as a code execution/command invocation risk (details vary by report). Remediation i...

CVE-2019-10800 Command Injection

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method...

CVE-2019-10800

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method...

CVE-2019-10800: Improper Neutralization of Argument Delimiters in a Command

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method...

PT-2022-8076 · Codecov +1 · Codecov +1

Name of the Vulnerable Software and Affected Versions: codecov versions prior to 2.0.16 Description: The issue arises from the failure to sanitize gcov arguments before they are provided to the popen method. This lack of sanitization can lead to potential exploitation. Recommendations: For versio...

Codecov parameter injection vulnerability

codecov is a specialized code coverage solution open-sourced by codecov. A security vulnerability exists in codecov versions prior to 2.0.16, which stems from not cleaning up the gcov parameter before supplying it to the popen method...

@aliyun-sls/sql (>=0.2.9-dev-10, <=0.3.10-dev-9), @dpjayasekara/tscore (>=0.0.1, <=0.1.1) +29 more potentially affected by CVE-2020-7596 via codecov (>=3.0.0, <=3.6.1)

codecov NPM version =3.0.0, =0.2.9-dev-10, =0.0.1, =0.0.29, =1.0.10, =1.0.18, =1.0.0, =1.7.0, =1.0.1, =1.0.8, =0.1.1, =0.1.6, =0.1.1, =0.0.1, =1.17.0, =1.22.16 and more Source cves: CVE-2020-7596 Source advisory: OSV:GHSA-MH2H-6J8Q-X246...

GHSA-MH2H-6J8Q-X246 Improper Neutralization of Special Elements in Output Used by a Downstream Component in Codecov

Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument...

@aliyun-sls/sql (>=0.2.9-dev-10, <=0.3.10-dev-9), @dpjayasekara/tscore (>=0.0.1, <=0.1.1) +29 more potentially affected by CVE-2020-7596 via codecov (>=3.0.0, <=3.6.1)

codecov NPM version =3.0.0, =0.2.9-dev-10, =0.0.1, =0.0.29, =1.0.10, =1.0.18, =1.0.0, =1.7.0, =1.0.1, =1.0.8, =0.1.1, =0.1.6, =0.1.1, =0.0.1, =1.17.0, =1.22.16 and more Source cves: CVE-2020-7596 Source advisory: GHSA-MH2H-6J8Q-X246...

Improper Neutralization of Special Elements in Output Used by a Downstream Component in Codecov

Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument...

Securing the Supply Chain: Lessons Learned from the Codecov Compromise

Supply chain attacks are all the rage these days. While they’re not a new part of the threat landscape, they are growing in popularity among more sophisticated threat actors, and they can create significant system-wide disruption, expense, and loss of confidence across multiple organizations,...

Google Releases New Framework to Prevent Software Supply Chain Attacks

As software supply chain attacks emerge as a point of concern in the wake of SolarWinds and Codecov security incidents, Google is proposing a solution to ensure the integrity of software packages and prevent unauthorized modifications. Called "Supply chain Levels for Software Artifacts" SLSA, and...

Replacement of bash script by an attacker to one that includes malicious commands in Codecov Bash uploader version All versions downloaded from Jan 2021 through April 2021. Because the attacker had control of the script the version # included in it cannot be trusted.

In Codecov Codecov Bash uploader version All versions downloaded from Jan 2021 through April 2021. Because the attacker had control of the script the version included in it cannot be trusted. a Replacement of bash script by an attacker to one that includes malicious commands exists in the The Bas...