Read the docs

codecov

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

codecov records in CISA KEV

No codecov vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Codecov 2 records MEDIUM Codecov-python 1 record LOW Nodejs Uploader 1 record MEDIUM

Records

2 records in Codecov · all components

TI-2020-11896 CVE-2020-15123 · GHSA-xp63-6vf5-xf3v

Command injection in codecov (npm package)

Priority MEDIUM 47

In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.03805 Published 2020-07-20 Fixed in 3.7.1 CWE-78
TI-2020-06119 CVE-2020-7597 · GHSA-5q88-cjfq-g2mh

OS command injection in codecov npm module

Priority MEDIUM 43

codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02918 Published 2020-02-17 Fixed in 3.6.5 CWE-78
Open these records in search →