PT-2020-19644 · Npm · Codecov

Published 2020-01-25 · Updated 2022-05-24 · CVE-2020-7596

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Codecov npm module versions prior to 3.6.2

Description The issue allows remote attackers to execute arbitrary commands via the gcov-args argument. This enables attackers to potentially gain control over the system.

Recommendations For versions prior to 3.6.2, update to version 3.6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the gcov-args argument to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

OS Command Injection

Weakness Enumeration

CWE-74

CWE-78

Related Identifiers

CVE-2020-7596

GHSA-MH2H-6J8Q-X246

SNYK-JS-CODECOV-543183

Affected Products

Codecov

References · 6

• 🔥 https://snyk.io/vuln/SNYK-JS-CODECOV-543183 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-7596 · Security Note
• https://osv.dev/vulnerability/GHSA-mh2h-6j8q-x246 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7596 · Vendor Advisory
• https://github.com/codecov/codecov-node · Note
• https://t.me/cvenotify/399 · Telegram Post