Description

Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument.

Remediation

References

https://snyk.io/vuln/SNYK-JS-CODECOV-543183

Related Vulnerabilities

CVE-2022-46751 Vulnerability in maven package org.apache.ivy:ivy

CVE-2022-35949 Vulnerability in npm package undici

CVE-2021-43859 Vulnerability in maven package com.thoughtworks.xstream:xstream

CVE-2020-7760 Vulnerability in npm package codemirror

CVE-2023-26486 Vulnerability in npm package vega

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Patch Third Party Advisory