CVE-2020-7597: OS Command Injection
codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/codecovto a version that resolves this vulnerability.Fixed in 3.6.5 - Upgrade
Upgrade
codecov-node npm moduleto a version that resolves this vulnerability.Fixed in 3.6.5
Event History
Frequently Asked Questions
What is the severity of CVE-2020-7597?
CVE-2020-7597 has been classified with a critical severity rating due to its ability to allow remote command execution.
How do I fix CVE-2020-7597?
To remediate CVE-2020-7597, update the codecov npm module to version 3.6.5 or later.
What versions of codecov are affected by CVE-2020-7597?
CVE-2020-7597 affects versions of codecov prior to 3.6.5.
Who is at risk from CVE-2020-7597?
Any application or service using codecov versions below 3.6.5 is at risk of being exploited by this vulnerability.
What is the exploit mechanism for CVE-2020-7597?
CVE-2020-7597 allows attackers to execute arbitrary commands through improper handling of the gcov-root argument in the exec function.