CVE-2020-15123

In codecov npm package before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. A similar CVE CVE-2020-7597 for GHSA-5q88-cjfq-g2mh was...

@authereum/resolution (>=1.10.4 <=1.10.4-beta.4), @blocksx/bulk (>=0.1.3-alpha.0 <=0.3.0) +151 more potentially affected by CVE-2020-15123 via codecov (>=1.0.1 <=3.7.0)

codecov NPM version =1.0.1, =1.10.4, =0.1.3-alpha.0, =0.1.19-alpha.0, =0.1.11-alpha.0, =0.1.3-alpha.0, =1.0.8, =1.0.0, =0.0.1, =0.0.1, =0.1.2-dev-1, =1.0.12-52 and more Source cves: CVE-2020-15123 Source advisory: OSV:GHSA-XP63-6VF5-XF3V...

CVE-2020-15123

The CVE-2020-15123 entry concerns the npm package codecov-node (used with the Codecov npm package). A vulnerable path is the upload method, which allows command injection. The underlying issue is in how input is handled in the upload flow, enabling execution of arbitrary commands if malicious inp...

@authereum/resolution (>=1.10.4 <=1.10.4-beta.4), @chemistry/crystalview (>=1.0.8 <=1.0.9) +144 more potentially affected by CVE-2020-15123 +1 more via codecov (>=1.0.1 <=3.6.1)

codecov NPM version =1.0.1, =1.10.4, =1.0.8, =1.0.0, =0.0.1, =0.0.1, =0.1.2-dev-1, =1.0.0, =0.0.29, =1.0.0, =1.0.10, =1.0.18, =1.0.0, =1.0.12 and more Source cves: CVE-2020-15123, CVE-2020-7597 Source advisory: OSV:GHSA-5Q88-CJFQ-G2MH...