Read the docs
TI-2020-11896 Aliases CVE-2020-15123GHSA-xp63-6vf5-xf3v

Command injection in codecov (npm package)

Priority MEDIUM 47CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. A similar CVE (CVE-2020-7597 for GHSA-5q88-cjfq-g2mh) was issued but the fix was incomplete. It only blocked &, and command injection is still possible using backticks instead to bypass the sanitizer. The attack surface is low in this case. Particularly in the standard use of codecov, where the module is used directly in a build pipeline, not built against as a library in another application that may supply malicious input and perform command injection.

Why it matters now

EPSS 0.03805 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed codecov-node (codecov): 3.7.1codecov (npm): 3.7.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
codecovcodecov-nodebefore 3.7.13.7.1Patch availableCNA
—codecov (npm)before 3.7.13.7.1Patch availableGHSA-xp63-6vf5-xf3v
  • codecov-node Vendorcodecov Affected before 3.7.1 Fixed in 3.7.1 Patch available CNA
  • codecov (npm) Vendor— Affected before 3.7.1 Fixed in 3.7.1 Patch available GHSA-xp63-6vf5-xf3v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:codecov:codecov:*:*:*:*:*:node.js:*:*before 3.7.1Vulnerablecodecov
  • cpe:2.3:a:codecov:codecov:*:*:*:*:*:node.js:*:* Versions before 3.7.1 Vulnerable ·codecov

Remediation

  • Fix · CNA codecov-node (codecov) Fixed in 3.7.1
  • Fix · GHSA-xp63-6vf5-xf3v codecov (npm) Fixed in 3.7.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15123
  2. 2026-10-03 Alias added: GHSA-xp63-6vf5-xf3v
  3. 2026-10-30 EPSS moved to the 90th–95th percentile

References

Exploit 1

Patch 1

Advisory 4

  • TI-2020-06119 OS command injection in codecov npm module CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences