~ / search / GHSA-mh2h-6j8q-x246

GHSA-mh2h-6j8q-x246

Improper Neutralization of Special Elements in Output Used by a Downstream Component in Codecov

Source: GitHub Advisory Database (reviewed) High CVE-2020-7596

Packages

EcosystemPackageAffectedFixed in
npm codecov < 3.6.2 3.6.2

Details

As written in the advisory (Markdown source, shown as plain text).

Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument.

References

External links from the advisory. They lead to third-party sites.