Description

Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument.

Remediation

References

https://snyk.io/vuln/SNYK-JS-CODECOV-543183

Related Vulnerabilities

CVE-2020-14967 Vulnerability in maven package org.webjars.bower:jsrsasign

CVE-2020-7701 Vulnerability in npm package madlib-object-utils

CVE-2019-10744 Vulnerability in maven package org.webjars.bowergithub.lodash:lodash

CVE-2021-4307 Vulnerability in maven package org.webjars.bower:baobab

CVE-2018-3766 Vulnerability in npm package buttle

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Patch Third Party Advisory