GHSA-h3qr-fjhm-jphw

Codecov does not sanitize gcov arguments

Source: GitHub Advisory Database (reviewed) High CVE-2019-10800

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	codecov	< 2.0.16	2.0.16

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10800 advisory
https://github.com/codecov/codecov-python/commit/2a80aa434f74feb31242b6f213b75ce63ae97902 web
https://github.com/advisories/GHSA-h3qr-fjhm-jphw advisory
https://github.com/codecov/codecov-python package
https://github.com/pypa/advisory-database/tree/main/vulns/codecov/PYSEC-2022-238.yaml web
https://snyk.io/vuln/SNYK-PYTHON-CODECOV-552149 web