CVE-2020-7597

2020-02-1718:48:40

snyk

www.cve.org

9.3 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.2%

JSON

codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596.

CNA Affected

[
  {
    "product": "codecov npm module",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to version 3.6.5"
      }
    ]
  }
]