CVE-2020-7597 codecov NPM module allows remote attackers to execute arbitrary commands
Remote attackers can execute arbitrary commands via the gcov-root argument in the codecov-node npm module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7597?
CVE-2020-7597 is a high-severity command injection vulnerability in codecov npm module, published on 17 Feb 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596.
Weakness: CWE-78
Which versions are affected by CVE-2020-7597?
2 open source packages ship an affected version, including codecov. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
codecov npm | All versions | 3.6.5 |
codecov npm | All versions | 3.6.5 |
Products include Codecov Codecov.
How do I fix CVE-2020-7597?
Upgrade codecov to 3.6.5 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-7597 being exploited?
There is no known exploitation of CVE-2020-7597 in the wild and no public exploit code.
Other vulnerabilities in codecov npm module
Sources
Also known as GHSA-5q88-cjfq-g2mh, SNYK-JS-CODECOV-548879.